{"id":"CVE-2026-119707","kind":"vulnerability","aliases":["CVE-2026-119707"],"related":[],"title":"SonicJS: authors and editors can modify other users' documents via API","description":"SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.","summary":"SonicJS through 3.0.0 has a missing authorization check on its /api/:collection and /api/content write routes, which only check coarse role labels. An authenticated author or editor can create, change, publish or soft-delete other users' documents, bypassing document access rules and administrator deny overrides.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sonicjs","fixed":[],"affected":"<= 3.0.0","ecosystem":"npm"}],"ecosystems":[],"tags":["cms","package","self-hosted","sonicjs"],"not_affected_if":["admin-only-writes","no-content-api"],"how_to_check":"- Check the installed SonicJS version in `package.json` or the lockfile; versions through `3.0.0` are listed as affected.\n- Review whether the app exposes the `/api/:collection` and `/api/content` write routes to users with the author or editor role.","fix":null,"status":"open","published_at":"2026-10-30T16:17:51+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:32:03+00:00","updated_at":"2026-10-30T16:33:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T16:32:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SonicJS: authors and editors can modify other users' documents via API","impact":"medium","summary":"SonicJS through 3.0.0 has a missing authorization check on its /api/:collection and /api/content write routes, which only check coarse role labels. An authenticated author or editor can create, change, publish or soft-delete other users' documents, bypassing document access rules and administrator deny overrides.","audience":"developers","category":"package","nicknames":[],"who_cares":["sonicjs","self-hosted","cms"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated low-privilege users alter or delete other users' documents","analyst_note":"Confirm the fixed version from the SonicJS repository or advisory at the NVD link; sources give no patched release.","how_to_check":"- Check the installed SonicJS version in `package.json` or the lockfile; versions through `3.0.0` are listed as affected.\n- Review whether the app exposes the `/api/:collection` and `/api/content` write routes to users with the author or editor role.","plain_action":"","needs_analyst":true,"not_affected_if":["admin-only-writes","no-content-api"],"who_is_affected":"Sites running SonicJS through 3.0.0 where authors or editors hold API tokens or JWTs and can write content through the API. Sites that restrict write access to administrators, or do not use the content API, are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":4142,"output_tokens":549,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version from the SonicJS repository or advisory at the NVD link; sources give no patched release.","search":"'-119707':14A,17A '-2026':13A,16A '/api':35B,81C '/api/content':38B,84C '3.0.0':27B,73C 'access':65B 'acl':118C 'administr':68B,120C 'api':11A,103C 'authent':48B,93C 'author':2A,31B,49B,77C,94C 'bearer':100C 'bypass':63B,116C 'chang':54B 'check':32B,43B,89C 'cms':19B 'coars':44B,90C 'collect':36B,82C 'contain':74C 'creat':53B,106C 'cve':12A,15A 'delet':59B,112C 'deni':69B,121C 'document':9A,62B,64B,115C,117C 'editor':4A,51B,96C 'host':23B 'jwt':101C 'key':104C 'label':46B,92C 'miss':30B,76C 'modifi':6A,107C 'overrid':70B,122C 'packag':20B 'publish':55B,108C 'role':45B,91C 'rout':40B,86C 'rule':66B 'self':22B 'self-host':21B 'soft':58B,111C 'soft-delet':57B,110C 'sonicj':1A,24B,25B,71C 'sonicjs':18A 'use':98C 'user':8A,61B,114C 'via':10A 'vulner':78C 'write':39B,85C","nicknames":[],"mitigations":[],"who_affected":"Sites running SonicJS through 3.0.0 where authors or editors hold API tokens or JWTs and can write content through the API. Sites that restrict write access to administrators, or do not use the content API, are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T16:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119707","severity":null,"published_at":"2026-10-30T16:17:51+00:00","modified_at":"2026-10-30T16:17:51+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119707:1174","url":null,"severity":null,"published_at":"2026-10-30T16:33:54+00:00","modified_at":"2026-10-30T16:33:54+00:00","first_seen_at":"2026-10-30T16:33:54+00:00","fetched_at":"2026-10-30T16:33:54+00:00","note":"Only NVD found; no SonicJS advisory or release naming this CVE, and no v3.0.1 page found, so fixed version is unknown. v3.0.0 (stable, ~Oct 2026) introduced document-backed RBAC with per-document ACLs, which this bug bypasses. Check github.com/SonicJs-Org/sonicjs/security/advisories and releases after 3.0.0 to settle it. Nothing verified."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}