CVE-2026-110131: falha de média gravidade em LiuYuYang01 ThriveX-Server
ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.3%
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
LiuYuYang01 · ThriveX-ServerReferências
https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/controller/ArticleController.java#L82-L102https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.java#L228-L270https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.java#L318-L356https://github.com/LiuYuYang01/ThriveX-Server/releases/tag/4.0https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/thrivex-server-draft-article-unauth-disclosurehttps://www.vulncheck.com/advisories/thrivex-server-through-4.0-missing-authorization-via-article-retrieval-endpoints