RSSAnt CVE-2026-117562

Exploitation requires that the rssant instance has the publish feature active - i.e., at least one user has called user_publish.set with is_enable=True - so that the anonymous publish.story_get endpoint is reachable; the attacker supplies a publish unionid via the X-RSSANT-PUBLISH header. The bypass specifically defeats the is_all_public=False setting: stories from feeds the owner left as is_publish=False are returned when they should be rejected ('does not exist'). Limiting factors: the publishing feature must be in use, and feed_id values are encoded unionids combining user.id and feed.id, so the attacker must enumerate/guess valid IDs and offsets. Impact is confined to confidentiality of private feed story content - no authentication is required (PR:N confirmed from the CVSS vector), but no integrity or availability impact exists.

This is a genuine but moderate-severity information-disclosure issue, not a high-urgency emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.9 and reflects an unauthenticated (PR:N), network-reachable flaw with low confidentiality impact only - no integrity or availability effect, consistent with CWE-639 (authorization bypass through user-controlled key). The vulnerability mechanism is confirmed directly by the vendor patch diff: UnionStory.get_by_id ignored the only_publish flag (the code even carried a 'TODO: filter by only_publish' comment), so the anonymous publish.story_get endpoint returned stories from feeds the owner had not marked public. No EPSS score, KEV status, or SSVC automatable/technical-impact signals were provided in the input, so probabilistic exploitation likelihood cannot be quantified here; the only decision signal is the vuln.today priority label 'this_month', which aligns with a real-but-not-critical issue rather than act_now/emergency. The product is a niche self-hosted RSS reader, which further limits real-world attack surface. Net: treat as a legitimate authorization-bypass bug warranting the available patch on the vendor's suggested timeline, not a drop-everything event.

An attacker reaches an internet-exposed rssant instance where at least one user has enabled feed publishing, obtains an anonymous publish unionid, and then calls the publish.story_get endpoint while enumerating encoded feed IDs and story offsets. Because the only_publish filter was not applied, the attacker retrieves story content from feeds the owner kept private (is_publish=False). No public exploit identified at time of analysis, though the vendor patch and its added test case fully document the request sequence.