GHSA-x5cc-8486-8qqx: Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools
Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling contentgetdocument and contentlistdocuments without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Authenticated low-privileged users who have both the ai.chat and content.edit.own capabilities can exploit the affected MCP content read tools. No user interaction is required.
Is the normal HTTP API affected in the same way?
The normal HTTP API enforces object-level authorization checks. The bypass occurs through the MCP interface when content_get_document or content_list_documents is called.
What information could an attacker retrieve?
An attacker may retrieve data rows belonging to other users, including private or unpublished draft content. They may also enumerate rows in the posts system table.
What version addresses the vulnerability?
Instatic versions before 0.0.21 are affected. Version 0.0.21 is identified by the provided release reference as the relevant fixed release.