MEDIUM 6.9 NVD
CVE-2026-110131
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated at
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.
References
- https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/we
- https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/we
- https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/we
- https://github.com/LiuYuYang01/ThriveX-Server/releases/tag/4.0
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/thrivex-server-draft-article-unauth-disclosure
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-10-13 via NVD.
vulnfeed aggregates 13242 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.