CVE-2026-110131: ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any deployment of ThriveX-Server through version 4.0 that exposes the affected article API endpoints over the network is exposed. No authentication is required to retrieve the affected non-public articles.
What does an attacker need to exploit it?
An attacker only needs network access to the GET /api/article or GET /api/article/{id} endpoints. They can enumerate sequential article IDs or use the isDraft=true or isDel=true query parameters.
What information can be disclosed?
The affected endpoints can return the full title, description, and content of unpublished draft and soft-deleted articles.