CVE-2026-125398

HIGH 7.1

Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.

CWE	CWE-862
Vendor	corebunch
Product	instatic
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for corebunch instatic

Be the first to know when new high vulnerabilities affecting corebunch instatic are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

CoreBunch / Instatic

0 < 0.0.21

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v github.com: https://github.com/CoreBunch/Instatic/commit/ff1e51eb59c860864fa24e8c3e2716b56314f3ad github.com: https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21 github.com: https://github.com/CoreBunch/Instatic/blob/v0.0.20/server/handlers/cms/data/rows.ts#L378-L398 vulncheck.com: https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint

Credits

Sriman Aluvala