{"id":"CVE-2026-125398","kind":"vulnerability","aliases":["CVE-2026-125398"],"related":[],"title":"Instatic: authorization bypass lets users read and reassign table rows","description":"Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.","summary":"Instatic before 0.0.21 has an authorization check in handleRowAuthor that is skipped when rows are loaded through getDataRow(). An authenticated user with content.edit.any but without data.system.tables.read can read system-table rows and reassign their authors through the PATCH /admin/api/cms/data/rows/:id/author endpoint.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","instatic","package","self-hosted"],"not_affected_if":["no-authenticated-editors","version-0.0.21-or-later"],"how_to_check":"- Check the installed Instatic version: `instatic --version` or the version in package.json, and see whether it is below `0.0.21`.\n- Review user roles for accounts holding `content.edit.any` that lack `data.system.tables.read`.","fix":"- Upgrade Instatic to `0.0.21` or later.","status":"open","published_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","triaged_at":"2026-11-10T00:30:07+00:00","updated_at":"2026-11-10T00:30:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T00:30:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Instatic to `0.0.21` or later.","reach":"network","title":"Instatic: authorization bypass lets users read and reassign table rows","impact":"medium","summary":"Instatic before 0.0.21 has an authorization check in handleRowAuthor that is skipped when rows are loaded through getDataRow(). An authenticated user with content.edit.any but without data.system.tables.read can read system-table rows and reassign their authors through the PATCH /admin/api/cms/data/rows/:id/author endpoint.","audience":"businesses","category":"package","nicknames":[],"who_cares":["instatic","self-hosted","cms"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated editor reads system-table rows and reassigns authorship","analyst_note":"unknown","how_to_check":"- Check the installed Instatic version: `instatic --version` or the version in package.json, and see whether it is below `0.0.21`.\n- Review user roles for accounts holding `content.edit.any` that lack `data.system.tables.read`.\n- unknown for further detail on deployment-specific exposure.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.0.21-or-later","no-authenticated-editors"],"who_is_affected":"Teams running Instatic before 0.0.21 that have authenticated users with content.edit.any permission who lack data.system.tables.read. Exposure depends on those authenticated roles existing; unauthenticated visitors cannot use this path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000753,"input_tokens":4667,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125398':13A,16A '-2026':12A,15A '/admin/api/cms/data/rows':62B,105C '0.0.21':25B,67C 'access':84C 'allow':76C 'attack':94C 'authent':42B,77C 'author':2A,28B,58B,70C,116C 'bypass':3A,71C 'check':29B,85C 'cms':17B 'contain':68C 'content.edit.any':45B,96C 'cve':11A,14A 'data.system.tables.read':48B,99C 'endpoint':64B 'getdatarow':40B,90C 'handlerowauthor':31B,74C 'hold':95C 'host':22B 'id/author':63B,106C 'instat':1A,18B,23B,65C 'instead':91C 'lack':98C 'let':4A 'level':83C 'load':38B,87C 'loadrowforaccess':93C 'packag':19B 'patch':61B,102C 'read':6A,50B,108C 'reassign':8A,56B,114C 'request':103C 'row':10A,36B,54B,88C,112C 'self':21B 'self-host':20B 'send':101C 'skip':34B,80C 'system':52B,110C 'system-t':51B,109C 'tabl':9A,53B,82C,111C 'table-level':81C 'user':5A,43B,78C 'vulner':72C 'without':47B","nicknames":[],"mitigations":[],"who_affected":"Teams running Instatic before 0.0.21 that have authenticated users with content.edit.any permission who lack data.system.tables.read. Exposure depends on those authenticated roles existing; unauthenticated visitors cannot use this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","high","instatic","package","selfhosted"],"campaign_type":null,"search_a":"'-125398':13A,16A '-2026':12A,15A 'author':2A 'bypass':3A 'cve':11A,14A 'instat':1A 'let':4A 'read':6A 'reassign':8A 'row':10A 'tabl':9A 'user':5A","search_b":"'/admin/api/cms/data/rows':62B '0.0.21':25B 'authent':42B 'author':28B,58B 'check':29B 'cms':17B 'content.edit.any':45B 'data.system.tables.read':48B 'endpoint':64B 'getdatarow':40B 'handlerowauthor':31B 'host':22B 'id/author':63B 'instat':18B,23B 'load':38B 'packag':19B 'patch':61B 'read':50B 'reassign':56B 'row':36B,54B 'self':21B 'self-host':20B 'skip':34B 'system':52B 'system-t':51B 'tabl':53B 'user':43B 'without':47B","search_c":"'/admin/api/cms/data/rows':105C '0.0.21':67C 'access':84C 'allow':76C 'attack':94C 'authent':77C 'author':70C,116C 'bypass':71C 'check':85C 'contain':68C 'content.edit.any':96C 'data.system.tables.read':99C 'getdatarow':90C 'handlerowauthor':74C 'hold':95C 'id/author':106C 'instat':65C 'instead':91C 'lack':98C 'level':83C 'load':87C 'loadrowforaccess':93C 'patch':102C 'read':108C 'reassign':114C 'request':103C 'row':88C,112C 'send':101C 'skip':80C 'system':110C 'system-t':109C 'tabl':82C,111C 'table-level':81C 'user':78C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T09:48:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125398","severity":null,"published_at":"2026-11-10T00:17:14+00:00","modified_at":"2026-11-10T00:17:14+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","fetched_at":"2026-11-10T00:28:44+00:00","note":null}],"documents":[{"id":111595,"url":"https://github.com/CoreBunch/Instatic/commit/ff1e51eb59c860864fa24e8c3e2716b56314f3ad","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":57747,"url":"https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111597,"url":"https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T09:48:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":111598,"url":"https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}