ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-110131 · Microsoft / collected KEV context

cve-program · CVE-2026-110131

• https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/thrivex-server-draft-article-unauth-disclosure
• https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.java#L228-L270
• https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.java#L318-L356
• https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/controller/ArticleController.java#L82-L102
• https://github.com/LiuYuYang01/ThriveX-Server/releases/tag/4.0
• https://www.vulncheck.com/advisories/thrivex-server-through-4.0-missing-authorization-via-article-retrieval-endpoints

No related operational record is retained in the current change model.