---
id: "CVE-2026-121458"
kind: "vulnerability"
aliases: ["CVE-2026-121458"]
title: "Instatic: AI/MCP read tools expose other users' private drafts"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "instatic", "mcp", "self-hosted"]
not_affected_if: ["no-ai-chat-capability", "no-ai-mcp-tools", "version-0.0.21-or-later"]
published_at: "2026-11-03T13:17:21+00:00"
first_seen_at: "2026-11-03T13:20:52+00:00"
updated_at: "2026-11-03T13:21:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121458", "first_seen_at": "2026-11-03T13:20:52+00:00"}]
---

# Instatic: AI/MCP read tools expose other users' private drafts

Instatic before 0.0.21 has an AI/MCP content tool that skips the per-user access checks the normal HTTP API enforces. A logged-in low-privilege user can read other users' private and unpublished drafts and enumerate rows in the posts table.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Instatic version and compare it with `0.0.21`
- Look for the `content_get_document` and `content_list_documents` MCP tools in the deployment's MCP configuration
- Confirm whether users hold the `ai.chat` and `content.edit.own` capabilities

## Fix

- Upgrade Instatic to `0.0.21` or later (per the advisory's stated fixed version)

## Timeline

- 2026-11-03T13:20:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121458

## Documents

- [advisory] Vendor advisory: github.com https://github.com/CoreBunch/Instatic/security/advisories/GHSA-x5cc-8486-8qqx
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/instatic-before-authorization-bypass-via-mcp-content-read-tools
- [fix] Release notes: github.com https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21

## From the sources

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_