CVE-2026-125398

Name of the Vulnerable Software and Affected Versions Instatic versions prior to 0.0.21

Description An authorization bypass exists in the handleRowAuthor() function. Authenticated users with content.edit.any permissions, but without data.system.tables.read permissions, can bypass table-level access checks. This occurs because the system uses getDataRow() instead of loadRowForAccess() to load rows. An attacker can exploit this by sending PATCH requests to the '/admin/api/cms/data/rows/:id/author' endpoint to read system-table rows and reassign their authors.

Recommendations Update to version 0.0.21 or later.