Threats affecting pkg:github/anyant/rssant

rssant versions 1.9.0 through 1.9.1 have an authorization bypass vulnerability allowing unauthenticated attackers to read stories from unpublished feeds via the anonymous publish.story_get endpoint. This occurs because the UnionStory.get_by_feed_offset function ignores the only_publish flag, enabling enumeration of feed IDs and offsets to access private feed stories.