CVE-2026-125398

7.1 HIGHpublic exploit available

Published 2026-11-10 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weaknesses

CWE-862

Public exploit & PoC references

https://github.com/CoreBunch/Instatic/blob/v0.0.20/server/handlers/cms/data/rows.ts#L378-L398
https://github.com/CoreBunch/Instatic/commit/ff1e51eb59c860864fa24e8c3e2716b56314f3ad
https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21
https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v

All references

https://github.com/CoreBunch/Instatic/blob/v0.0.20/server/handlers/cms/data/rows.ts#L378-L398
https://github.com/CoreBunch/Instatic/commit/ff1e51eb59c860864fa24e8c3e2716b56314f3ad
https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21
https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v
https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-11455
MEDIUMCVE-2025-12523PoC
MEDIUMCVE-2025-1397
MEDIUMCVE-2025-14484
MEDIUMCVE-2025-14486
MEDIUMCVE-2025-14487
MEDIUMCVE-2025-62819
MEDIUMCVE-2025-7043

Related by shared AI tags and CWE weakness class. Browse the full archive.