Live › vulnerability › CVE-2026-111610
Go to dashboardB3log Solo through 4.4.0 has a missing ownership check in its ArticleConsole, so any logged-in author can list other authors' drafts and read draft content. An authenticated author can also use the push2rhy function to publish other authors' articles to the Rhythm community.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running B3log Solo 4.4.0 or earlier with more than one author account are exposed, since the flaw lets one author reach another author's drafts. Single-author installs have no other authors' articles to reach, and deployments without author accounts are not affected.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draft content via the k parameter, and use push2rhy to push others' articles to the Rhythm community.
This page as .md · .json · in your agent: get_signal("CVE-2026-111610")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.