PT-2026-126421
CVE-2026-117562
·
تاريخ النشر
2026-10-27
·
تاريخ التحديث
2026-10-27
الوصف من
CVSS 3.1
5.3
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story get endpoint. Because UnionStory.get by feed offset ignores the only publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾