4 matches found
CVE-2026-119707
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents,...
CVE-2026-119707
SonicJS versions through 3.0.0 are vulnerable to a missing authorization vulnerability (CWE-862) within the /api/:collection and /api/content write routes. The root cause is that these routes only perform coarse role label checks, failing to validate specific document permissions. This allows aut...
CVE-2026-119707 SonicJS through 3.0.0 Missing Authorization in Content Write API
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents,...
PT-2026-133641
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents,...