CVE-2026-125398: CoreBunch Instatic: Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated…

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow instead of loadRowForAccess. Attackers holding content.edit.any but lacking data.system.tables.read can send...