rachelos CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM rachelos CVE published 2026-10-14

CVE-2026-110617

CVE-2026-110617 is a missing authorization vulnerability in we-mp-rss through version 1.5.3. The vulnerability exists in the /api/v1/wx/tools/export/download endpoint, allowing unauthenticated attackers to download export archives. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs. They can also set delete_after_download=true to delete the arc [truncated]