SonicJS: Missing authorization in API write routes (CVE-2026-119707)

SonicJS through 3.0.0 implements improper authorization checks within its API write routes, specifically '/api/:collection' and '/api/content'. While the application verifies role-based labels for authentication, it fails to enforce document-level Access Control Lists (ACLs). This vulnerability allows authenticated users with 'Author' or 'Editor' roles to perform unauthorized actions including creation, modification, publication, and deletion of documents belonging to other users, successfully bypassing administrative deny overrides.

Impact

Authenticated attackers with minimal privileges (Author/Editor) can gain unauthorized control over site content, overwrite documents owned by other users, or delete data, leading to a compromise of content integrity and unauthorized data manipulation across the application.

Recommendation

• Inventory all instances of SonicJS in the environment and verify the version is at 3.0.0 or below.
• Monitor API traffic to '/api/:collection' and '/api/content' for unauthorized attempts by users with 'Author' or 'Editor' roles.
• Audit document logs for unexpected modifications or deletions performed by users outside of the document ownership scope.