An authorization bypass flaw in rssant versions 1.9.0 through 1.9.1 allows unauthenticated attackers to retrieve stories from unpublished feeds via the publish.story_get endpoint. The vulnerability stems from the UnionStory.get_by_feed_offset function disregarding the only_publish flag, enabling enumeration of feed identifiers and offsets to access private feed content. As a result, attackers can read any unpublished stories that belong to the target account, exposing potentially sensitive content without requiring credentials.

The vulnerability affects anyant's rssant product. All installations running rssant version 1.9.0 or 1.9.1 are affected. No other versions are listed as vulnerable.

The CVSS score of 6.9 indicates a moderate risk level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not documented. Attackers can exploit the flaw by sending unauthenticated HTTP requests to the publish.story_get endpoint and iterating feed IDs and offsets to gather private stories. The weakness is classified as CWE‑639, an authorization bypass by insecure permission logic.