Is CVE-2026-110131 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110131?

CVE-2026-110131 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-110131

Description

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.