GHSA-m425-wmrc-4v4v: Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint
Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Instaticto a version that resolves this vulnerability.Fixed in 0.0.21
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Authenticated users with the content.edit.any permission are able to exploit it even if they do not have data.system.tables.read.
What does an attacker need to do to exploit the flaw?
The attacker must send a PATCH request to /admin/api/cms/data/rows/:id/author for a target row. The affected handler loads the row without performing the intended table-level access check.
What could an attacker do after exploitation?
An attacker can read system-table rows and reassign their authors.
What versions should be remediated?
Instatic versions before 0.0.21 are affected. Upgrade to 0.0.21 or later.
What activity should be investigated for possible exploitation?
Review PATCH requests to /admin/api/cms/data/rows/:id/author, particularly requests made by accounts that have content.edit.any but lack data.system.tables.read.