CVE-2026-110131 Details

A missing authorization vulnerability has been identified in ThriveX-Server versions through 4.0. The issue resides in the GET /api/article and /api/article/{id} endpoints, which are accessible without authentication. This vulnerability allows unauthenticated attackers to read unpublished draft articles and soft-deleted posts. Attackers can exploit this by requesting sequential article IDs or by using the isDraft=true or isDel=true query parameters to access the full titles, descriptions, and content of these non-public articles.

The vulnerability can be addressed by adding a check for draft articles in the non-admin access block of the getArticleData method. Additionally, the processArticleData and getArticleList methods should be modified to ignore client-supplied isDraft and isDel parameters for non-admin requests.