{"id":"CVE-2026-125398","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-125398","summary":"Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow()…","details":"Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.","published":"2026-11-09T23:28:01.464Z","modified":"2026-11-09T23:28:01.464Z","cvss":{"score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/CoreBunch/Instatic/commit/ff1e51eb59c860864fa24e8c3e2716b56314f3ad","label":"CoreBunch/Instatic@ff1e51e"},"references":[{"type":"ADVISORY","url":"https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v"},{"type":"FIX","url":"https://github.com/CoreBunch/Instatic/commit/ff1e51eb59c860864fa24e8c3e2716b56314f3ad"},{"type":"WEB","url":"https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21"},{"type":"WEB","url":"https://github.com/CoreBunch/Instatic/blob/v0.0.20/server/handlers/cms/data/rows.ts#L378-L398"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-09T23:28:01.464Z"}}