Medium severity5.3NVD Advisory· Published Oct 13, 2026
CVE-2026-110131
CVE-2026-110131
Description
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.
Affected products
1- Range: <4.0
Patches
Vulnerability mechanics
References
6- github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/controller/ArticleController.javanvd
- github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.javanvd
- github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.javanvd
- github.com/LiuYuYang01/ThriveX-Server/releases/tag/4.0nvd
- hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/thrivex-server-draft-article-unauth-disclosurenvd
- www.vulncheck.com/advisories/thrivex-server-through-4.0-missing-authorization-via-article-retrieval-endpointsnvd
News mentions
0No linked articles in our index yet.