EUVD-2026-98895
GHSA-75r3-hhfq-mmwm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public /api/article endpoint
-
ExploitAppend isDraft=true/isDel=true or enumerate IDs
-
ImpactRetrieve unpublished draft and soft-deleted content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of ThriveX-Server through 4.0; the attacker needs only network access to the public blog API, with no credentials, user interaction, or non-default setting required. The sole limiting factor is scope of impact: exposure is confined to reading non-public article content (drafts marked isDraft and soft-deleted items marked isDel), with no write, authentication-bypass-to-admin, or availability effect. Note that 4.0 removed RBAC in favor of single-user mode, so there is no role model mitigating the public read path. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 (Medium) and is internally consistent with the description: exploitation is remote, low-complexity, requires no authentication (PR:N) and no user interaction, making it trivially reachable against any internet-facing ThriveX blog API. However, impact is deliberately narrow - only VC:L (low confidentiality) with VI:N/VA:N/SC:N - i.e. unauthorized read of non-public article content, with no integrity or availability consequence. No EPSS probability, no CISA KEV entry, and no formal POC/exploit-code flag were provided in the input, so there is no signal of active or automated exploitation; a public technical write-up (hackmd) does document the exact isDraft=true/isDel=true technique, which lowers the bar to reproduce. On balance this is a genuine but low-to-moderate priority: easy to exploit but limited to information disclosure of drafts/soft-deleted posts in a niche product, not a system-compromise issue. No conflicting signals were found between the vector and the description - both agree on unauthenticated network access with confidentiality-only impact. |
| Exploit ScenarioDerived | An unauthenticated attacker sends GET requests to a public ThriveX blog's /api/article or /api/article/{id} endpoint, either enumerating sequential article IDs or appending isDraft=true or isDel=true query parameters. The server's missing authorization check (CWE-862) returns the full title, description, and body of unpublished drafts and soft-deleted articles. No exploit code is published, but a hackmd advisory details the exact parameters needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated information disclosure in ThriveX-Server through 4.0 lets any remote attacker read non-public article content - including drafts and soft-deleted posts - from the public blog API. The GET /api/article and /api/article/{id} endpoints omit an authorization check on the publication state of the returned record, so an attacker can simply pass isDraft=true or isDel=true as query parameters, or walk sequential article IDs, to retrieve the full title, description and body of articles the operator never intended to publish. The issue requires no credentials, no user interaction and no special configuration (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N, 6.9 Medium; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and there is no public exploit identified at time of analysis and no CISA KEV listing, though a public technical write-up of the disclosure exists and the vulnerable source lines are linked from the advisory.
RemediationAI
No vendor-released patch identified at time of analysis: the referenced 4.0 release is the latest tagged version in the repository, and no fixed version or commit-level fix is identified in the supplied references, so operators should not assume an upgrade path resolves this today. Until a patched release appears, the most effective compensating control is to stop unauthenticated clients from reaching the article retrieval API at all - place the /api/article and /api/article/{id} routes behind an authenticating reverse proxy, API gateway or mTLS boundary, keeping only the genuinely public, published-only read path exposed; the trade-off is that anonymous visitors must continue to see published posts, so the rule has to distinguish public listing traffic from filter-parameter access rather than blanket-blocking the endpoint. Second, block or strip requests carrying the isDraft and isDel query parameters at the WAF/reverse-proxy layer and log them as high-fidelity indicators of attempted abuse - the trade-off is that the admin front-end may legitimately use these parameters for draft preview and recycle-bin views, so the block must be scoped to unauthenticated sessions and the admin path allow-listed by source or session. Third, reduce enumerability by ensuring unauthenticated responses never expose sequential IDs and by rate-limiting per-client ID-walking patterns on /api/article/{id}. Fourth, treat any draft or soft-deleted content held on an internet-facing instance as potentially already disclosed and rotate or review sensitive unpublished material accordingly. Monitor the vendor repository at https://github.com/LiuYuYang01/ThriveX-Server/releases/tag/4.0 and the VulnCheck advisory at https://www.vulncheck.com/advisories/thrivex-server-through-4.0-missing-authorization-via-article-retrieval-endpoints for a fixed build; if a fix is published, the exact patched version should be taken from that advisory rather than assumed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ThriveX-Server is a Java/Spring Boot blog backend (the blog module ships as liuyuyang.net.web.controller.ArticleController), and the flaw is a textbook CWE-862 Missing Authorization case rather than a memory-safety or injection defect. The controller's GET /api/article and GET /api/article/{id} handlers at ArticleController.java lines 82-102 delegate to ArticleServiceImpl.java (notably lines 228-270 and 318-356), which build the query directly from caller-supplied filter parameters such as isDraft and isDel without first establishing whether the requester is entitled to see unpublished or soft-deleted rows. Because article identifiers are sequential, the missing check also makes the non-public content set trivially enumerable even without supplying the filter parameters. The design context matters: ThriveX 4.0's release notes state that the legacy RBAC menu and role model was removed in favour of a single-user mode, so there is no residual role layer that might otherwise have gated the public read path. The impact class is confidentiality-only and low severity per the assessed vector - the attacker reads content that was withheld, but cannot write, escalate to administrative access, or degrade availability, and the exposed data is limited to drafts (isDraft) and soft-deleted articles (isDel).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote, low-complexity, unauthenticated API access with no user interaction (AV:N/AC:L/PR:N/UI:N); only low confidentiality impact from disclosed draft content, no integrity or availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB