Live › vulnerability › CVE-2026-119707
SonicJS through 3.0.0 has a missing authorization check on its /api/:collection and /api/content write routes, which only check coarse role labels. An authenticated author or editor can create, change, publish or soft-delete other users' documents, bypassing document access rules and administrator deny overrides.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Sites running SonicJS through 3.0.0 where authors or editors hold API tokens or JWTs and can write content through the API. Sites that restrict write access to administrators, or do not use the content API, are less exposed; the sources do not say more.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| sonicjs | npm | <= 3.0.0 | – |
package.json or the lockfile; versions through 3.0.0 are listed as affected./api/:collection and /api/content write routes to users with the author or editor role.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.
This page as .md · .json · in your agent: get_signal("CVE-2026-119707")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.