SonicJS CVE-2026-119707

Requires a valid, already-authenticated SonicJS account at author or editor role, presented as a bearer JWT or API key - it is NOT exploitable by fully unauthenticated users. The attacker targets the /api/:collection and /api/content write routes, which enforce only coarse role labels and fail to apply per-document ACLs or administrator deny overrides, allowing write/publish/soft-delete against documents the account does not own. Limiting factors: a low-privilege credential must be obtained first; the flaw affects SonicJS through 3.0.0; impact is confined to content integrity and soft-deletion (no data disclosure); and a vendor fix (PR #1147) removes the condition once applied.

This is a genuine but bounded authorization flaw (CWE-862) rather than a critical unauthenticated takeover. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the description agree: exploitation is network-based and low-complexity but requires an already-authenticated low-privilege account (PR:L - an author or editor holding a bearer JWT or API key), so this is NOT remote-unauthenticated. Impact is integrity-centric (VI:H - create/modify/publish/soft-delete of other users' documents, bypassing document ACLs and admin deny overrides) with limited availability impact (VA:L, via soft-delete) and no confidentiality impact (VC:N - the flaw is on write routes, not read disclosure). Decision signals point to prompt-but-not-emergency handling: the vuln.today priority label is 'this_week', the issue was reported by VulnCheck (with a dedicated advisory), and a vendor patch exists (PR #1147). No EPSS score and no KEV status were supplied in the input, so widespread or active exploitation cannot be asserted. A public PoC reference exists (a hackmd writeup of the ACL bypass) but it is not verified as working exploit code. Net: a real priority for any SonicJS deployment that grants author/editor accounts to semi-trusted users, but the required low-privilege foothold keeps this below a drop-everything emergency.

An attacker who already holds a low-privilege author or editor account on a SonicJS instance (via a bearer JWT or API key) sends write requests to the /api/:collection or /api/content routes, which only check coarse role labels. Because per-document ACLs and administrator deny overrides are not enforced, the attacker creates, modifies, publishes, or soft-deletes content owned by other users. A public writeup of the bypass exists but is not verified as working exploit code.