CVE-2026-125398
Received Received - Intake

Authorization Bypass in Instatic CMS via Row Access Handling

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125398
EUVD
EUVD-2026-120561

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
CoreBunch Instatic From 0 (inc) to 0.0.21 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Instatic versions before 0.0.21. It allows authenticated users with the content.edit.any permission but lacking data.system.tables.read to bypass table-level access checks. By sending PATCH requests to /admin/api/cms/data/rows/:id/author, attackers can read and reassign authorship of system-table rows, such as unpublished pages or posts, without proper authorization.

Detection Guidance

Check Instatic version with: curl -s https://your-instatic-instance/admin/api/version | grep version. If version is before 0.0.21, the system is vulnerable. Monitor logs for PATCH requests to /admin/api/cms/data/rows/:id/author from users without data.system.tables.read permission.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data like private drafts or unpublished content. Attackers could view, modify, or reassign authorship of restricted rows, potentially causing data integrity violations or exposing confidential information. The impact includes confidentiality breaches and unauthorized modifications.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized access or modification of such data could result in non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Instatic to version 0.0.21 or later immediately. If upgrading is not possible, restrict access to the PATCH /admin/api/cms/data/rows/:id/author endpoint and ensure users have only necessary permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125398. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...