CVE-2026-111610 in Solo
Summary
by MITRE • 10/16/2026
B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draft content via the k parameter, and use push2rhy to push others' articles to the Rhythm community.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in B3log Solo versions up to 4.4.0 represents a critical failure in access control mechanisms within the ArticleConsole component of the blogging platform. This flaw is classified as an Insecure Direct Object Reference, corresponding to CWE-639 in the Common Weakness Enumeration standard. The core technical issue stems from the absence of proper authorization checks that verify whether the authenticated user initiating a request owns or has permission to access the specific article resources being queried. Instead of validating ownership against the session context or database records associated with the requesting user, the application relies on insufficient logic that allows any logged-in author to interact with articles belonging to other authors simply by manipulating input parameters.
From an operational perspective, this vulnerability enables authenticated attackers who possess valid credentials for a low-privilege account to perform unauthorized actions against higher-value targets within the same system. By omitting per-author ownership checks in the ArticleConsole endpoints, an attacker can enumerate and inspect articles created by other users on the platform. The attack vector involves querying specific console article status endpoints where the application fails to restrict access based on user identity relative to the resource owner. This lack of server-side validation allows for a broad range of malicious activities ranging from information disclosure to content manipulation without requiring privilege escalation or external exploitation techniques beyond valid authentication.
The impact of this vulnerability is multifaceted, affecting both confidentiality and integrity within the blogging ecosystem. Attackers can utilize the k parameter to probe draft content, effectively reading sensitive unpublished material intended only for specific authors. This exposure compromises intellectual property and potentially reveals personal information or strategic plans contained in drafts before they are publicly released. Furthermore, the vulnerability extends beyond passive data access through the push2rhy functionality. An attacker can force other users' articles to be pushed to the Rhythm community without their consent. This action violates user autonomy, potentially exposing authors to unwanted public scrutiny, reputational damage, or association with content that may conflict with their personal views or professional standards.
In terms of threat modeling and adversary behavior, this vulnerability aligns with techniques observed in the MITRE ATT&CK framework, specifically those related to Collection via Application Layer Protocol and Unauthorized Access to Resources. The ability to list drafts corresponds to reconnaissance activities where an attacker gathers intelligence on active users and their unpublished work. The subsequent probing of content represents data exfiltration from internal systems. These actions demonstrate how a simple logic flaw in access control can be leveraged for significant malicious outcomes, turning a standard authentication requirement into a gateway for lateral movement within the application's user base.
To mitigate this vulnerability, developers must implement strict object-level authorization checks on all endpoints related to article management and status retrieval. This involves verifying that the authenticated user ID matches the owner ID of the requested resource before processing any read or write operations. Additionally, input validation should be reinforced to ensure that parameters like k are sanitized and restricted to authorized contexts only. The push2rhy functionality requires similar scrutiny to prevent unauthorized propagation of content. Regular security audits focusing on access control logic and automated testing for broken object level authorization will help identify such gaps early in the development lifecycle. Updating to a patched version where these ownership checks are correctly enforced is essential for maintaining the integrity and confidentiality of user-generated content within the B3log Solo environment.