{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/sonicjs/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sonicjs:sonicjs:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-119707"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SonicJS (\u003c= 3.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SonicJS"],"content_html":"\u003cp\u003eSonicJS through 3.0.0 implements improper authorization checks within its API write routes, specifically '/api/:collection' and '/api/content'. While the application verifies role-based labels for authentication, it fails to enforce document-level Access Control Lists (ACLs). This vulnerability allows authenticated users with 'Author' or 'Editor' roles to perform unauthorized actions including creation, modification, publication, and deletion of documents belonging to other users, successfully bypassing administrative deny overrides.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAuthenticated attackers with minimal privileges (Author/Editor) can gain unauthorized control over site content, overwrite documents owned by other users, or delete data, leading to a compromise of content integrity and unauthorized data manipulation across the application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of SonicJS in the environment and verify the version is at 3.0.0 or below.\u003c/li\u003e\n\u003cli\u003eMonitor API traffic to '/api/:collection' and '/api/content' for unauthorized attempts by users with 'Author' or 'Editor' roles.\u003c/li\u003e\n\u003cli\u003eAudit document logs for unexpected modifications or deletions performed by users outside of the document ownership scope.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T17:36:54Z","date_published":"2026-10-30T17:36:54Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sonicjs-auth-bypass/","summary":"SonicJS versions through 3.0.0 contain a missing authorization vulnerability in API routes that allows authenticated Authors or Editors to bypass document-level ACLs and modify content owned by other users.","title":"SonicJS: Missing authorization in API write routes (CVE-2026-119707)","url":"https://feed.craftedsignal.io/briefs/2026-10-sonicjs-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - SonicJS","version":"https://jsonfeed.org/version/1.1"}