{"id":"CVE-2026-129143","kind":"vulnerability","aliases":["CVE-2026-129143"],"related":[],"title":"paicoding: missing authorization lets anyone read paid and draft articles","description":"paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles.","summary":"paicoding 1.0.3 has a missing authorization check on its article detail endpoint, GET /article/api/data/detail/{articleId}. An unauthenticated attacker can enumerate article IDs and read full content of paid, login-only, member-only and draft articles.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"paicoding","fixed":[],"affected":"1.0.3","ecosystem":"maven"}],"ecosystems":[],"tags":["java","package","paicoding","self-hosted","unauthenticated"],"not_affected_if":["other-versions","static-export"],"how_to_check":"Check the deployed paicoding version (pom.xml or release tag) for 1.0.3. Then request GET /article/api/data/detail/{articleId} without a session cookie for a paid or draft article ID; full content in the response means exposed. The advisory names ArticleRestController.java L87-L94.","fix":"No fixed version published as of 2026-11-13; upstream issue #137 is open. Until a fix lands, restrict the endpoint at a reverse proxy or require login in front of /article/api/data/detail/.","status":"open","published_at":"2026-11-13T18:17:39+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","triaged_at":"2026-11-13T18:51:23+00:00","updated_at":"2026-11-13T18:54:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T18:51:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"paicoding: missing authorization lets anyone read paid and draft articles","impact":"medium","summary":"paicoding 1.0.3 has a missing authorization check on its article detail endpoint, GET /article/api/data/detail/{articleId}. An unauthenticated attacker can enumerate article IDs and read full content of paid, login-only, member-only and draft articles.","audience":"businesses","category":"package","nicknames":[],"who_cares":["paicoding","self-hosted","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated readers obtain full content of paid and draft articles.","analyst_note":"Find the fixed version and any upstream patch in the paicoding repository or the VulnCheck advisory at www.vulncheck.com; the sources give no fix.","how_to_check":"- Confirm the deployed paicoding version, for example by checking the project's pom.xml or release tag, and see whether it is `1.0.3`.\n- Request `GET /article/api/data/detail/{articleId}` without a session cookie on a paid or draft article ID and see whether the full content is returned.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions","static-export"],"who_is_affected":"Teams that run paicoding as a self-hosted article or knowledge platform with paid, login-only, member-only or draft content. The sources do not say which version fixes it or whether a configuration change mitigates it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000738,"input_tokens":4592,"output_tokens":558,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and any upstream patch in the paicoding repository or the VulnCheck advisory at www.vulncheck.com; the sources give no fix.","search":"'-129143':13A,16A '-2026':12A,15A '/article/api/data/detail':38B,90C '1.0.3':26B,63C 'allow':76C 'anyon':5A 'articl':10A,34B,45B,61B,72C,82C,86C,106C 'articleid':39B,91C 'articlerestcontrol':71C 'attack':42B,78C,83C 'author':3A,30B,67C 'check':31B 'contain':64C 'content':50B,95C 'cve':11A,14A 'detail':35B,73C 'draft':9A,60B,105C 'endpoint':36B,74C 'enumer':44B,85C 'full':49B,94C 'get':37B,89C 'host':23B 'id':46B,87C 'java':18B 'let':4A 'login':54B,99C 'login-on':53B,98C 'member':57B,102C 'member-on':56B,101C 'miss':2A,29B,66C 'packag':19B 'paicod':1A,20B,25B,62C 'paicoding':17A 'paid':7A,52B,97C 'read':6A,48B,80C 'restrict':81C 'retriev':93C 'self':22B 'self-host':21B 'unauthent':24B,41B,77C 'via':88C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host paicoding 1.0.3 (itwanger/paicoding) and keep paid, login-only, member-only or draft articles on it. Anyone who can reach the site can read them without logging in by requesting GET /article/api/data/detail/{articleId}. Sites with no restricted content, or not on 1.0.3, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["paicoding"],"ptokens":["paicoding"],"labels":["high","java","package","paicoding","selfhosted","unauthenticated"],"campaign_type":null,"search_a":"'-129143':13A,16A '-2026':12A,15A 'anyon':5A 'articl':10A 'author':3A 'cve':11A,14A 'draft':9A 'let':4A 'miss':2A 'paicod':1A 'paicoding':17A 'paid':7A 'read':6A","search_b":"'/article/api/data/detail':38B '1.0.3':26B 'articl':34B,45B,61B 'articleid':39B 'attack':42B 'author':30B 'check':31B 'content':50B 'detail':35B 'draft':60B 'endpoint':36B 'enumer':44B 'full':49B 'get':37B 'host':23B 'id':46B 'java':18B 'login':54B 'login-on':53B 'member':57B 'member-on':56B 'miss':29B 'packag':19B 'paicod':20B,25B 'paid':52B 'read':48B 'self':22B 'self-host':21B 'unauthent':24B,41B","search_c":"'/article/api/data/detail':90C '1.0.3':63C 'allow':76C 'articl':72C,82C,86C,106C 'articleid':91C 'articlerestcontrol':71C 'attack':78C,83C 'author':67C 'contain':64C 'content':95C 'detail':73C 'draft':105C 'endpoint':74C 'enumer':85C 'full':94C 'get':89C 'id':87C 'login':99C 'login-on':98C 'member':102C 'member-on':101C 'miss':66C 'paicod':62C 'paid':97C 'read':80C 'restrict':81C 'retriev':93C 'unauthent':77C 'via':88C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129143","severity":null,"published_at":"2026-11-13T18:17:39+00:00","modified_at":"2026-11-13T18:17:39+00:00","first_seen_at":"2026-11-13T18:49:29+00:00","fetched_at":"2026-11-13T18:49:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129143:3925","url":"https://github.com/itwanger/paicoding/issues/137","severity":null,"published_at":"2026-11-13T18:54:44+00:00","modified_at":"2026-11-13T18:54:44+00:00","first_seen_at":"2026-11-13T18:54:44+00:00","fetched_at":"2026-11-13T18:54:44+00:00","note":"VulnCheck advisory + upstream issue #137 (open, reported 2026-11-12, one of 7 findings); no fix or patch found in sources. Affects 1.0.3 only per advisory.","cites":["https://github.com/itwanger/paicoding/issues/137"]}],"documents":[{"id":148607,"url":"https://www.vulncheck.com/advisories/paicoding-1.0.3-missing-authorization-via-article-detail-api-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":148675,"url":"https://github.com/itwanger/paicoding/issues/137","title":"paicoding #137 [SECURITY] 7 vulnerabilities (open, no fix)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}