Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-125398

Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Corebunch
Products
Instatic
CVE-2026-121458

Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Corebunch
Products
Instatic
CVE-2026-72587

Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Corebunch
Products
Instatic