CVE-2026-110131 — ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read u…
Published: 2026-10-13 · CVSS: 6.9 · CVSS 4.0
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7