rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The rssant feed reader software, in versions from 1.9.0 through 1.9.1, is affected by a flaw that lets people without logging in read articles from feeds that were never made public. An attacker could guess feed identifiers and positions to pull out private content they should not be able to see.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- anyant rssant
From 1.9.0 · through 1.9.1