CVE-2026-111610 — B3log Solo through 4.4.0 Missing Authorization in ArticleConsole
B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-aut…
Published: 2026-10-16 · CVSS: 5.3 · CVSS 4.0
B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draft content via the k parameter, and use push2rhy to push others' articles to the Rhythm community.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7