{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/instatic--0.0.21/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:instatic:instatic:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-125398"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Instatic (\u003c 0.0.21)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Instatic"],"content_html":"\u003cp\u003eInstatic versions before 0.0.21 contain an authorization bypass vulnerability within the handleRowAuthor function. The vulnerability arises because the application uses an insecure data retrieval method, getDataRow(), instead of the required loadRowForAccess() method, which correctly enforces table-level access controls. An authenticated user possessing the 'content.edit.any' permission, but lacking the 'data.system.tables.read' permission, can leverage this flaw to access restricted data or reassign authorship.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthorized authenticated users to bypass table-level access controls, specifically enabling the reading of system-table rows and the modification of row authorship.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Instatic to version 0.0.21 or later to remediate the vulnerable handleRowAuthor logic.\u003c/li\u003e\n\u003cli\u003eReview audit logs for unauthorized PATCH requests directed at the /admin/api/cms/data/rows/:id/author endpoint, specifically from users lacking system-level data permissions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T02:05:01Z","date_published":"2026-11-10T02:05:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-instatic-auth-bypass/","summary":"Instatic versions prior to 0.0.21 contain an authorization bypass vulnerability allowing authenticated users with limited permissions to read and modify system-table rows via direct API interaction.","title":"Instatic: Authorization bypass in handleRowAuthor (CVE-2026-125398)","url":"https://feed.craftedsignal.io/briefs/2026-11-instatic-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Instatic (\u003c 0.0.21)","version":"https://jsonfeed.org/version/1.1"}