Live › vulnerability › CVE-2026-121458
Instatic before 0.0.21 has an AI/MCP content tool that skips the per-user access checks the normal HTTP API enforces. A logged-in low-privilege user can read other users' private and unpublished drafts and enumerate rows in the posts table.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 13:20 UTC. All times on this page are UTC.
Instatic installations before 0.0.21 that expose the AI/MCP content tools to users who have the ai.chat and content.edit.own capabilities. Any user with those capabilities can read content owned by other users, so deployments where only trusted single-user accounts exist carry less risk. Sites that do not use the AI/MCP feature can skip it.
No product ranges from the sources yet.
0.0.21content_get_document and content_list_documents MCP tools in the deployment's MCP configurationai.chat and content.edit.own capabilities0.0.21 or later (per the advisory's stated fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-121458")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.