---
id: "CVE-2026-125398"
page: "https://infrastack.ai/live/CVE-2026-125398"
kind: "vulnerability"
aliases: ["CVE-2026-125398"]
title: "Instatic: authorization bypass lets users read and reassign table rows"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "instatic", "package", "self-hosted"]
not_affected_if: ["no-authenticated-editors", "version-0.0.21-or-later"]
published_at: "2026-11-10T00:17:14+00:00"
first_seen_at: "2026-11-10T00:28:44+00:00"
updated_at: "2026-11-10T00:30:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125398", "first_seen_at": "2026-11-10T00:28:44+00:00"}]
exploit_sources: []
---

# Instatic: authorization bypass lets users read and reassign table rows

Link for people: https://infrastack.ai/live/CVE-2026-125398 (this .md is for agents)

Instatic before 0.0.21 has an authorization check in handleRowAuthor that is skipped when rows are loaded through getDataRow(). An authenticated user with content.edit.any but without data.system.tables.read can read system-table rows and reassign their authors through the PATCH /admin/api/cms/data/rows/:id/author endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Instatic version: `instatic --version` or the version in package.json, and see whether it is below `0.0.21`.
- Review user roles for accounts holding `content.edit.any` that lack `data.system.tables.read`.

## Fix

- Upgrade Instatic to `0.0.21` or later.

## Timeline

- 2026-11-10T00:28:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125398

## Documents

- [advisory] Vendor advisory: github.com https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint
- [fix] Patch: github.com https://github.com/CoreBunch/Instatic/commit/ff1e51eb59c860864fa24e8c3e2716b56314f3ad
- [fix] Release notes: github.com https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21

## From the sources

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_