EUVD-2026-120561

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow instead of loadRowForAccess. Attackers holding content.edit.any but lacking data.system.tables.read can send...