CVE-2026-110131 ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...

CVE-2026-110131

ThriveX-Server versions through 4.0 are vulnerable to a missing authorization vulnerability (CWE-862) within the GET /api/article and /api/article/{id} endpoints. This flaw allows unauthenticated attackers to access non-public content, including unpublished drafts and soft-deleted articles . Expl...