Missing Authorization Vulnerability in Paicoding Article API
CVE-2026-129143

8.7HIGH

Key Information:

Vendor

Itwanger

Status
Paicoding
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129143?

Paicoding version 1.0.3 contains a significant vulnerability in its ArticleRestController's article detail endpoint. This flaw allows unauthenticated attackers to access restricted content by utilizing the endpoint GET /article/api/data/detail/{articleId}. Through this method, attackers can enumerate valid article IDs, potentially retrieving full content from paid, member-only, login-required, and even draft articles, thereby compromising user privacy and content integrity.

Affected Version(s)

paicoding 1.0.3

References

https://vul.yulun.ac.cn/20261112/paicoding/
third-party-advisory
https://github.com/itwanger/paicoding/issues/137
issue-tracking
https://github.com/itwanger/paicoding/blob/903adce70309d3...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.