CVE-2026-111610
Received Received - Intake

Missing Authorization in B3log Solo ArticleConsole

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draft content via the k parameter, and use push2rhy to push others' articles to the Rhythm community.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111610
EUVD
EUVD-2026-103032

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
b3log Solo 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111610 is a missing authorization vulnerability in B3log Solo through version 4.4.0. It allows authenticated authors to access other authors' articles by bypassing ownership checks in the ArticleConsole. Attackers can list drafts, probe content via the k parameter, and push others' articles to the Rhythm community without proper validation.

Detection Guidance

To detect this vulnerability, inspect network traffic for unauthorized access to the ArticleConsole endpoints. Check logs for requests to /console/articles/status or /console/article/push2rhy with parameters like k. Use curl commands to test if non-admin authors can access other authors' drafts or push articles without ownership checks.

  • curl -X GET 'http://<target>/console/articles/status?status=DRAFT' -H 'Cookie: JSESSIONID=<session>'
  • curl -X POST 'http://<target>/console/article/push2rhy' -H 'Cookie: JSESSIONID=<session>' -d 'articleId=<other_author_article_id>'
Impact Analysis

This vulnerability can lead to unauthorized access to other authors' drafts and published articles, exposing sensitive or unpublished content. Attackers may exfiltrate draft data, manipulate article visibility, or push unauthorized content to external communities, compromising confidentiality and integrity.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR and HIPAA by enabling unauthorized access to sensitive user-generated content. It risks exposing personal or confidential data, leading to potential non-compliance with privacy and security requirements.

Mitigation Strategies

Immediately upgrade to a patched version of B3log Solo beyond 4.4.0. Temporarily restrict access to the ArticleConsole endpoints for non-admin users. Review logs for signs of exploitation and revoke unauthorized access. Apply strict ownership validation in ArticleConsole and ArticleQueryService.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart