Missing Authorization in ThriveX-Server API Allows Unauthorized Access to Articles
CVE-2026-110131

6.9MEDIUM

Key Information:

Vendor

Liuyuyang01

Status
Thrivex-server
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110131?

ThriveX-Server versions up to 4.0 are affected by a vulnerability that permits unauthenticated users to access unpublished draft articles and soft-deleted content through specific API endpoints (/api/article and /api/article/{id}). Attackers can exploit this flaw by sequentially querying article IDs or using parameters like isDraft=true or isDel=true to retrieve sensitive article details, including titles, descriptions, and full content that should remain private.

Affected Version(s)

ThriveX-Server 0 <= 4.0

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/thrivex-server-...
third-party-advisory
https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/bl...
technical-description
https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/bl...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.