B3log Solo EUVD-2026-103032

Requires a valid authenticated author-level account on the target Solo instance (PR:L) and a deployment with more than one author so that other authors' articles exist to access - single-author blogs have nothing to cross-access. The attacker reaches the console articles-status endpoint and supplies the k parameter to probe draft content, and push2rhy must be usable to publish others' articles to the Rhythm community. No user interaction and no special non-default configuration beyond multi-author usage is needed; the limiting factor is the prior author-account requirement, which keeps this to registered users rather than anonymous internet attackers.

This is a medium-severity, authorization-logic flaw (CWE-639, IDOR) rather than a high-urgency issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reachability and low attack complexity, but PR:L means the attacker must already hold a valid authenticated author account on the Solo instance - this is an insider/registered-user privilege escalation across tenants, not anonymous remote compromise. Impact is bounded: VC:L/VI:L/VA:N (limited confidentiality of other authors' drafts and limited integrity via unauthorized publishing), with no availability impact and no scope change (SC:N/SI:N/SA:N). No EPSS score, KEV listing, or vendor-declared exploitation status was provided in the input, so exploitation probability signals are absent - this should be read as 'no exploitation data available' rather than 'low risk confirmed.' A detailed third-party technical write-up (hackmd) and the exact vulnerable source lines are publicly referenced, which lowers the barrier to developing an exploit, but no packaged exploit tool is indicated in the input. Net: a legitimate but not emergency priority - prioritize for multi-author Solo deployments where untrusted users can register authors; deprioritize for single-author blogs where no second author account exists to abuse.

A registered author on a shared B3log Solo blog (one allowing multiple author accounts) logs in and queries the console article-status endpoint, which fails to filter results to the caller's own articles. They enumerate and read other authors' unpublished drafts via the k parameter, then invoke push2rhy to publish a victim's private article to the Rhythm community without authorization. A public technical write-up describing this exact flow exists, though no packaged exploit tool is indicated in the provided data.