{"id":"CVE-2026-121458","kind":"vulnerability","aliases":["CVE-2026-121458"],"related":[],"title":"Instatic: AI/MCP read tools expose other users' private drafts","description":"Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.","summary":"Instatic before 0.0.21 has an AI/MCP content tool that skips the per-user access checks the normal HTTP API enforces. A logged-in low-privilege user can read other users' private and unpublished drafts and enumerate rows in the posts table.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","instatic","mcp","self-hosted"],"not_affected_if":["no-ai-chat-capability","no-ai-mcp-tools","version-0.0.21-or-later"],"how_to_check":"- Check the installed Instatic version and compare it with `0.0.21`\n- Look for the `content_get_document` and `content_list_documents` MCP tools in the deployment's MCP configuration\n- Confirm whether users hold the `ai.chat` and `content.edit.own` capabilities","fix":"- Upgrade Instatic to `0.0.21` or later (per the advisory's stated fixed version)","status":"open","published_at":"2026-11-03T13:17:21+00:00","first_seen_at":"2026-11-03T13:20:52+00:00","triaged_at":"2026-11-03T13:21:31+00:00","updated_at":"2026-11-03T13:21:31+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-03T13:21:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Instatic to `0.0.21` or later (per the advisory's stated fixed version)","reach":"network","title":"Instatic: AI/MCP read tools expose other users' private drafts","impact":"medium","summary":"Instatic before 0.0.21 has an AI/MCP content tool that skips the per-user access checks the normal HTTP API enforces. A logged-in low-privilege user can read other users' private and unpublished drafts and enumerate rows in the posts table.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["instatic","mcp","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated low-privilege users read other users' private drafts and table rows","analyst_note":"","how_to_check":"- Check the installed Instatic version and compare it with `0.0.21`\n- Look for the `content_get_document` and `content_list_documents` MCP tools in the deployment's MCP configuration\n- Confirm whether users hold the `ai.chat` and `content.edit.own` capabilities","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.0.21-or-later","no-ai-mcp-tools","no-ai-chat-capability"],"who_is_affected":"Instatic installations before 0.0.21 that expose the AI/MCP content tools to users who have the ai.chat and content.edit.own capabilities. Any user with those capabilities can read content owned by other users, so deployments where only trusted single-user accounts exist carry less risk. Sites that do not use the AI/MCP feature can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4251,"output_tokens":603,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121458':12A,15A '-2026':11A,14A '0.0.21':26B,70C 'access':38B,95C 'ai':17B 'ai-tool':16B 'ai.chat':90C 'ai/mcp':2A,29B,78C 'allow':83C 'api':43B,123C 'attack':124C 'authent':87C 'author':74C,116C 'belong':98C 'call':103C 'capabl':93C 'check':39B,117C 'contain':71C 'content':30B,79C,104C,108C,136C 'content.edit.own':92C 'cross':148C 'cross-us':147C 'cve':10A,13A 'data':96C,150C 'disclosur':151C 'document':106C,110C 'draft':9A,60B,135C 'enforc':44B,118C 'enumer':62B,138C 'expos':5A 'get':105C 'host':23B 'http':42B,122C 'instat':1A,19B,24B,68C 'interfac':129C 'level':115C 'list':109C 'log':47B 'logged-in':46B 'low':50B,85C 'low-privileg':49B,84C 'mcp':20B,128C 'miss':73C 'normal':41B,121C 'object':114C 'object-level':113C 'per':36B 'per-us':35B 'post':66B,142C 'privat':8A,57B,132C 'privileg':51B,86C 'read':3A,54B,80C 'result':145C 'retriev':131C 'row':63B,97C,139C 'self':22B 'self-host':21B 'skip':33B 'system':143C 'tabl':67B,144C 'tool':4A,18B,31B,81C 'unpublish':59B,134C 'use':126C 'user':7A,37B,52B,56B,88C,101C,149C 'vulner':75C 'without':111C","nicknames":[],"mitigations":[],"who_affected":"Instatic installations before 0.0.21 that expose the AI/MCP content tools to users who have the ai.chat and content.edit.own capabilities. Any user with those capabilities can read content owned by other users, so deployments where only trusted single-user accounts exist carry less risk. Sites that do not use the AI/MCP feature can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","instatic","mcp","selfhosted"],"first_public_at":"2026-11-03T10:04:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121458","severity":null,"published_at":"2026-11-03T13:17:21+00:00","modified_at":"2026-11-03T13:17:21+00:00","first_seen_at":"2026-11-03T13:20:52+00:00","fetched_at":"2026-11-03T13:20:52+00:00","note":null}],"documents":[{"id":57747,"url":"https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":57748,"url":"https://github.com/CoreBunch/Instatic/security/advisories/GHSA-x5cc-8486-8qqx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T10:04:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":57749,"url":"https://www.vulncheck.com/advisories/instatic-before-authorization-bypass-via-mcp-content-read-tools","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}