Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-110131ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

Medium 5.3

In plain English

A medium-severity missing authorization in ThriveX-Server from LiuYuYang01. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 82.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.

Affected products (as reported)

Vendor	Product	Versions
LiuYuYang01	ThriveX-Server	0 – through 4.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/thrivex-server-draft-article-unauth-disclosure third-party-advisory
https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.java#L228-L270 technical-description
https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.java#L318-L356 technical-description
https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/controller/ArticleController.java#L82-L102 technical-description
ThriveX-Server 4.0 Release Notes release-notes
VulnCheck Advisory: ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints third-party-advisory