Rssant
Monthly
Authorization bypass in RSSAnt 1.9.0 through 1.9.1 lets unauthenticated attackers read stories from feeds whose owners never published them, by calling the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, a request carrying any valid publish unionid in the X-RSSANT-PUBLISH header plus an enumerated feed_id and offset returns private feed story content instead of the expected 'does not exist' rejection. Exposure is conditional on the instance's publishing feature being enabled by at least one user, and the attacker must guess encoded unionid feed identifiers and offsets; impact is limited to confidentiality of unpublished feed content with no integrity or availability effect, and no public exploit code or active exploitation was identified at time of analysis.
Authorization bypass in RSSAnt 1.9.0 through 1.9.1 lets unauthenticated attackers read stories from feeds whose owners never published them, by calling the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, a request carrying any valid publish unionid in the X-RSSANT-PUBLISH header plus an enumerated feed_id and offset returns private feed story content instead of the expected 'does not exist' rejection. Exposure is conditional on the instance's publishing feature being enabled by at least one user, and the attacker must guess encoded unionid feed identifiers and offsets; impact is limited to confidentiality of unpublished feed content with no integrity or availability effect, and no public exploit code or active exploitation was identified at time of analysis.