Skip to content
Threat Feed
Subscribe
high advisory

Instatic: Authorization bypass in handleRowAuthor (CVE-2026-125398)

Instatic versions prior to 0.0.21 contain an authorization bypass vulnerability allowing authenticated users with limited permissions to read and modify system-table rows via direct API interaction.

CVE search metadata

CVE search record: CVE-2026-125398. Severity: high. CVSS: 7.1. KEV: no. Product: Instatic (< 0.0.21). Brief: Instatic: Authorization bypass in handleRowAuthor (CVE-2026-125398). Brief link: https://feed.craftedsignal.io/briefs/2026-11-instatic-auth-bypass/

Triage facts

Revision 1
Applicability
Instatic (< 0.0.21)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 10, 02:05 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

Instatic versions before 0.0.21 contain an authorization bypass vulnerability within the handleRowAuthor function. The vulnerability arises because the application uses an insecure data retrieval method, getDataRow(), instead of the required loadRowForAccess() method, which correctly enforces table-level access controls. An authenticated user possessing the 'content.edit.any' permission, but lacking the 'data.system.tables.read' permission, can leverage this flaw to access restricted data or reassign authorship.

Impact

The vulnerability allows unauthorized authenticated users to bypass table-level access controls, specifically enabling the reading of system-table rows and the modification of row authorship.

Recommendation

  • Upgrade Instatic to version 0.0.21 or later to remediate the vulnerable handleRowAuthor logic.
  • Review audit logs for unauthorized PATCH requests directed at the /admin/api/cms/data/rows/:id/author endpoint, specifically from users lacking system-level data permissions.

Immediate actions

Patch Instatic to version 0.0.21 or later.

IT Operations 48h

Threat Hunt

Identify successful PATCH requests to the /admin/api/cms/data/rows/*/author endpoint from accounts without system administrator roles.

T1068 high high confidence hunt now

Data: Web server access logs, Application audit logs linking user ID to permissions

Mitigations

Upgrade Instatic to 0.0.21.

immediate IT Operations

CVE-2026-125398

Detection coverage 1

Detect Potential CVE-2026-125398 Exploitation - PATCH to Row Author Endpoint

high

Detects PATCH requests to the author modification endpoint which may indicate exploitation of the authorization bypass in Instatic

sigma tactics: privilege_escalation techniques: T1068 sources: webserver

Detection queries are available on the platform. Get full rules →