CVE-2026-129143: paicoding 1.0.3 Missing Authorization via Article Detail API Endpoint
paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any deployment of paicoding 1.0.3 that exposes the article detail API endpoint is potentially exposed. The issue affects restricted content categories including paid, login-only, member-only, and draft articles.
What does an attacker need to exploit it?
An attacker needs only network access to the endpoint and an article ID. No authentication, privileges, or user interaction are required.
How can defenders determine whether restricted content is exposed?
Test GET /article/api/data/detail/{articleId} using known IDs for paid, login-only, member-only, or draft articles while unauthenticated. Receiving the full article content indicates the deployment is affected.
What can be done if patching is not immediately possible?
Restrict unauthenticated access to the article detail API endpoint at the network, proxy, or application layer. Access controls should prevent anonymous requests from retrieving restricted and draft article content.