CVE-2026-129143
Received Received - Intake

Unauthenticated Article Content Exposure in paicoding

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-129143
EUVD
EUVD-2026-125617

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
itwanger paicoding 1.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

paicoding 1.0.3 has a missing authorization flaw in the ArticleRestController article detail endpoint. This allows unauthenticated attackers to read restricted articles by guessing article IDs via the GET /article/api/data/detail/{articleId} endpoint. They can access paid, login-only, member-only, and draft articles without proper permissions.

Detection Guidance

Check for unauthorized access to restricted articles by sending GET requests to /article/api/data/detail/{articleId} with various IDs. Monitor logs for unusual access patterns or repeated requests to article endpoints.

Impact Analysis

If you use paicoding 1.0.3, attackers could access sensitive or restricted articles without authentication. This may lead to data leaks, unauthorized access to premium content, or exposure of draft/internal articles. The impact depends on the nature of the restricted articles accessed.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR (data protection) or HIPAA (health data privacy) if restricted articles contain personal or sensitive data. Unauthorized access may lead to legal penalties, fines, or reputational damage due to non-compliance with data protection regulations.

Mitigation Strategies

Implement proper authorization checks on the ArticleRestController endpoint. Restrict access to /article/api/data/detail/{articleId} to authenticated users only. Update to a patched version of paicoding if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129143. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...