The vulnerability is an authorization bypass that allows anyone with network access to the ThriveX‑Server application to read unpublished draft articles and soft‑deleted articles without authentication. The GET /api/article and /api/article/{id} endpoints expose full titles, descriptions, and content of non‑public posts. Because the flaw does not require credential verification, sensitive business data and internal communications can be exposed to unauthenticated attackers, potentially revealing proprietary or confidential information. The weakness is classified as CWE‑862, reflecting a failure to verify access rights before returning data.

ThriveX‑Server version 4.0 and earlier are impacted. The flaw exists in the ArticleController and ArticleServiceImpl code paths that handle GET requests to /api/article and /api/article/{id}. Users running any released version of ThriveX‑Server up to and including 4.0 should assess whether their instance exposes these endpoints externally. No other vendors or major products are cited as affected in the CNA data.

The CVSS score of 6.9 indicates a moderate severity, largely due to the lack of authentication requirements and the confidentiality impact. EPSS data is not available, so the probability of exploitation is unknown, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending HTTP GET requests to the vulnerable endpoints over the network, either sequentially for article identifiers or by appending isDraft=true or isDel=true query parameters. The lack of any required authentication or access controls allows for straightforward remote data disclosure without privileged access. Given these characteristics, the risk is significant for environments where the API is exposed to untrusted networks.