CVE-2026-121458: Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools
Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Authenticated low-privileged users who have both the ai.chat and content.edit.own capabilities are exposed to this authorization gap.
What access does an attacker need to obtain another user's content?
The attacker needs a qualifying authenticated account and must invoke the MCP content_get_document or content_list_documents tools. No user interaction is required.
What information could be disclosed?
An attacker may retrieve private or unpublished draft content belonging to other users and enumerate rows in the posts system table.
Does the normal HTTP API have the same authorization gap?
The normal HTTP API enforces object-level authorization checks. The missing checks are in the MCP content read tools.
What version should be deployed to remediate the issue?
Upgrade to Instatic 0.0.21 or later. Versions before 0.0.21 are affected.