{"id":"CVE-2026-110131","summary":"ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints","details":"ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.","modified":"2026-10-15T02:47:39.133372285Z","published":"2026-10-13T16:53:23.021Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110131.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110131.json"},{"type":"ADVISORY","url":"https://github.com/LiuYuYang01/ThriveX-Server/releases/tag/4.0"},{"type":"ADVISORY","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/thrivex-server-draft-article-unauth-disclosure"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110131"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/thrivex-server-through-4.0-missing-authorization-via-article-retrieval-endpoints"},{"type":"PACKAGE","url":"https://github.com/LiuYuYang01/ThriveX-Server"},{"type":"ARTICLE","url":"https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/controller/ArticleController.java#L82-L102"},{"type":"ARTICLE","url":"https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.java#L228-L270"},{"type":"ARTICLE","url":"https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.java#L318-L356"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/liuyuyang01/thrivex-server","events":[{"introduced":"0"},{"fixed":"68319b582e5a4cf34bb86c81c5058ba41345b0ff"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"4.0"},{"fixed":"4.0"}],"source":["AFFECTED_FIELD","DESCRIPTION","REFERENCES"]}}],"versions":["3.2.2","3.2.1","3.2.0","3.1.5","3.1.4","3.1.3","3.1.2","3.1.1","3.1.0","3.0.3","3.0.2","3.0.1","2.5.9","2.5.8","2.5.7","2.5.4","2.5.3","2.5.2","2.5.1","2.5.0","2.4.9","2.4.8","2.4.7","2.4.6","2.4.5","2.4.4","2.4.3","2.4.2","2.4.1","2.3.1","2.1.4","2.1.3","2.1.2","2.1.1","2.1","2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110131.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}