CVE-2026-125398: CoreBunch Instatic: Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated…

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow instead of loadRowForAccess. Attackers holding content.edit.any but lacking data.system.tables.read can send...

CVE-2026-125398 Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow instead of loadRowForAccess. Attackers holding content.edit.any but lacking data.system.tables.read can send...

CVE-2026-125398

Instatic versions prior to 0.0.21 are susceptible to an authorization bypass vulnerability within the handleRowAuthor function. The root cause is the use of getDataRow() instead of loadRowForAccess(), which allows authenticated users to circumvent table-level access checks. Specifically, an attac...