CVE-2026-125398: Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint
Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Instaticto a version that resolves this vulnerability.Fixed in 0.0.21
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Authenticated users with the content.edit.any permission are able to exploit it, even if they do not have the data.system.tables.read permission. The issue affects Instatic versions before 0.0.21.
What access does an attacker need to exploit the vulnerability?
An attacker needs an authenticated account holding content.edit.any. They can send PATCH requests to the /admin/api/cms/data/rows/:id/author endpoint; no user interaction is required.
What can an attacker do through the affected endpoint?
They can bypass table-level access checks to read system-table rows and reassign the author of targeted rows. The reported impact includes high confidentiality impact and low integrity impact.
How can I determine whether my deployment is affected?
Deployments running a version earlier than 0.0.21 are affected if users can hold content.edit.any without data.system.tables.read. Review requests to the row-author PATCH endpoint for activity by accounts lacking system-table read permission.