Instatic (< 0.0.21) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/instatic--0.0.21/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 02:05:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgInstatic: Authorization bypass in handleRowAuthor (CVE-2026-125398)https://feed.craftedsignal.io/briefs/2026-11-instatic-auth-bypass/Tue, 10 Nov 2026 02:05:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-instatic-auth-bypass/Instatic versions prior to 0.0.21 contain an authorization bypass vulnerability allowing authenticated users with limited permissions to read and modify system-table rows via direct API interaction.Instatic versions before 0.0.21 contain an authorization bypass vulnerability within the handleRowAuthor function. The vulnerability arises because the application uses an insecure data retrieval method, getDataRow(), instead of the required loadRowForAccess() method, which correctly enforces table-level access controls. An authenticated user possessing the 'content.edit.any' permission, but lacking the 'data.system.tables.read' permission, can leverage this flaw to access restricted data or reassign authorship.

Impact

The vulnerability allows unauthorized authenticated users to bypass table-level access controls, specifically enabling the reading of system-table rows and the modification of row authorship.

Recommendation

  • Upgrade Instatic to version 0.0.21 or later to remediate the vulnerable handleRowAuthor logic.
  • Review audit logs for unauthorized PATCH requests directed at the /admin/api/cms/data/rows/:id/author endpoint, specifically from users lacking system-level data permissions.
]]>highadvisory