The vulnerability is a missing authorization check in the ArticleConsole component of B3log Solo. Because ownership validation is omitted, an authenticated author can query the console's articles-status endpoint and retrieve information about, and even edit, other authors' drafts. The flaw allows confidential content disclosure and potential manipulation of articles, leading to privacy violations and integrity compromise among users. The weakness aligns with CWE-639: Authorization bypass.

B3log Solo versions 4.4.0 and earlier are affected. The issue was identified in the source code referenced at the 4.4.0 tag and is pertinent to any deployment of Solo 4.4.0 that exposes the ArticleConsole API to authenticated users.

The flaw receives a CVSS score of 5.3, reflecting moderate impact. Because the EPSS score is unavailable and the vulnerability is not included in the CISA KEV list, there is no publicly reported exploitation yet, but the attack requires only an authenticated user with author privileges, making it readily exploitable on any installed instance. The lack of a mitigation check in the code makes the attack path straightforward via the /articles/status endpoint, suggesting that rapid patching or restriction of this endpoint is essential.