Cpe:2.3:a:sonicjs:sonicjs:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asonicjssonicjs/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 17:36:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSonicJS: Missing authorization in API write routes (CVE-2026-119707)https://feed.craftedsignal.io/briefs/2026-10-sonicjs-auth-bypass/Fri, 30 Oct 2026 17:36:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-sonicjs-auth-bypass/SonicJS versions through 3.0.0 contain a missing authorization vulnerability in API routes that allows authenticated Authors or Editors to bypass document-level ACLs and modify content owned by other users.SonicJS through 3.0.0 implements improper authorization checks within its API write routes, specifically '/api/:collection' and '/api/content'. While the application verifies role-based labels for authentication, it fails to enforce document-level Access Control Lists (ACLs). This vulnerability allows authenticated users with 'Author' or 'Editor' roles to perform unauthorized actions including creation, modification, publication, and deletion of documents belonging to other users, successfully bypassing administrative deny overrides.

Impact

Authenticated attackers with minimal privileges (Author/Editor) can gain unauthorized control over site content, overwrite documents owned by other users, or delete data, leading to a compromise of content integrity and unauthorized data manipulation across the application.

Recommendation

  • Inventory all instances of SonicJS in the environment and verify the version is at 3.0.0 or below.
  • Monitor API traffic to '/api/:collection' and '/api/content' for unauthorized attempts by users with 'Author' or 'Editor' roles.
  • Audit document logs for unexpected modifications or deletions performed by users outside of the document ownership scope.
]]>highadvisory