high · CVSS v3 7.1 · CVSS v4 7.1

CVE-2026-125398

Instatic before 0.0.21 has an authorization bypass in handleRowAuthor that lets authenticated users read and reassign authors of system-tabl

Overview

Instatic before 0.0.21 has an authorization bypass in handleRowAuthor that lets authenticated users read and reassign authors of system-table rows. The flaw allows users with content.edit.any but not data.system.tables.read to access protected data via PATCH /admin/api/cms/data/rows/:id/author. This can expose sensitive system data and alter ownership.

Description

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.

Impact

Confidentiality: unauthorized disclosure of system-table data. Integrity: attackers can reassign authors, potentially altering audit trails. Availability: not directly impacted. Defenders: administrators and security teams must verify access controls.

Remediation

Apply the official patch that updates Instatic to 0.0.21 or later. If patch unavailable, restrict content.edit.any permissions to users who also have data.system.tables.read, or block PATCH /admin/api/cms/data/rows/:id/author for non-admins. Monitor audit logs for unexpected author changes.

Risk context

Severity is high with CVSS 7.1. No EPSS data available. The vulnerability is exploitable by any authenticated user with content.edit.any, making it a moderate to high risk that should be addressed promptly.

Affected products

  • Instatic CMS

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.1
CVSS v4
7.1
EPSS
—

authorization-bypass cms instatic high-severity access-control data-exfiltration

← All CVEs

Related CVEs

high

CVE-2026-125074

A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.

View analysis

high

CVE-2026-125076

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

View analysis

high

CVE-2026-125078

A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

View analysis

high

CVE-2026-125360

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.

View analysis