---
id: "CVE-2026-119707"
kind: "vulnerability"
aliases: ["CVE-2026-119707"]
title: "SonicJS: authors and editors can modify other users' documents via API"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "sonicjs", "fixed": [], "affected": "<= 3.0.0", "ecosystem": "npm"}]
ecosystems: []
tags: ["cms", "package", "self-hosted", "sonicjs"]
not_affected_if: ["admin-only-writes", "no-content-api"]
published_at: "2026-10-30T16:17:51+00:00"
first_seen_at: "2026-10-30T16:31:26+00:00"
updated_at: "2026-10-30T16:33:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119707", "first_seen_at": "2026-10-30T16:31:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T16:33:54+00:00"}]
---

# SonicJS: authors and editors can modify other users' documents via API

SonicJS through 3.0.0 has a missing authorization check on its /api/:collection and /api/content write routes, which only check coarse role labels. An authenticated author or editor can create, change, publish or soft-delete other users' documents, bypassing document access rules and administrator deny overrides.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:sonicjs affected <= 3.0.0 fixed ?

## How to check

- Check the installed SonicJS version in `package.json` or the lockfile; versions through `3.0.0` are listed as affected.
- Review whether the app exposes the `/api/:collection` and `/api/content` write routes to users with the author or editor role.

## Timeline

- 2026-10-30T16:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119707
- 2026-10-30T16:33:54+00:00 analyst — Only NVD found; no SonicJS advisory or release naming this CVE, and no v3.0.1 page found, so fixed version is unknown. v3.0.0 (stable, ~Oct 2026) introduced document-backed RBAC with per-document ACLs, which this bug bypasses. Check github.com/SonicJs-Org/sonicjs/security/advisories and releases after 3.0.0 to settle it. Nothing verified.

## From the sources

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_