EUVD-2026-115812
GHSA-wq53-554h-vq3f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user (content.edit.own)
-
ExploitMint MCP token scoped to content.edit.own
-
ExecutionCall content_get_document / content_list_documents via MCP
-
ImpactRead and enumerate other users' private rows
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Instatic account (or an MCP bearer token) holding the ai.chat and content.edit.own capabilities, with the AI/MCP interface (the /_instatic/mcp endpoint) reachable to the attacker. Notably it does NOT require content.edit.any, data.system.tables.read, or ai.tools.write, and no LLM provider needs to be configured because the MCP endpoint can be called directly via JSON-RPC. The limiting factors are: a valid low-privileged account/token is needed (PR:L, not unauthenticated), the deployment must expose the AI/MCP content read tools, and impact is confined to read/enumeration of other users' rows in the same instance (no write or deletion). Deployments that do not enable or expose the MCP tool surface are not exposed. |
| Impact | This is a genuine but moderate-priority object-level authorization bypass (CWE-862/639/863) in Instatic's AI/MCP content read tools. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation with no user interaction, but PR:L means a valid authenticated account carrying the ai.chat and content.edit.own capabilities is required - this is not an unauthenticated internet-wide exploit. Impact is confidentiality-only (VC:H, VI:N/VA:N): an attacker reads and enumerates other users' private drafts and posts system-table rows but cannot modify or destroy data. No EPSS score was supplied and the CVE is not in CISA KEV, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a patch-promptly posture. The advisory includes a complete, screenshot-backed reproduction procedure, so a public PoC reference exists; it is not verified as working exploit code packaged for mass use. The main caveat is a CWE discrepancy: NVD labels this CWE-862 (missing authorization) while the GHSA labels it CWE-639/CWE-863 (improper authorization / incorrect authz) - these describe the same root cause (object-level checks enforced on the HTTP route but skipped on the MCP tool surface) and do not change the risk picture. Net: a real, well-documented flaw worth patching this week, tempered by the authenticated prerequisite and the limited (read-only, same-tenant) blast radius. |
| Exploit ScenarioDerived | A low-privileged authenticated user (or anyone who obtains such an account/token) in a multi-user Instatic instance mints an MCP access token scoped only to content.edit.own, then calls content_get_document and content_list_documents over the MCP endpoint. Because the AI/MCP tools skip the per-row ownership check that the HTTP API enforces, the attacker reads other users' unpublished private drafts and enumerates posts system-table rows, exfiltrating content they are denied via the normal API (which returns 404). A full step-by-step PoC with screenshots is published in the GHSA advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Cross-user data disclosure in Instatic before 0.0.21 lets any authenticated user holding only the low-privileged ai.chat and content.edit.own capabilities read other users' private drafts and enumerate rows in the posts system table through the AI/MCP interface. The content_get_document, content_list_documents and content_search_documents tools call the underlying data-row helpers directly and never apply the object-level ownership checks that the normal HTTP data-row route enforces (that route correctly returns 404 for the same request). No content.edit.any, data.system.tables.read or ai.tools.write privilege is needed, and no LLM provider has to be configured because the /_instatic/mcp JSON-RPC endpoint can be called directly with an MCP bearer token; a public PoC reference (reproduction steps and screenshots against 0.0.20) exists in the upstream advisory, though it is not verified as working exploit code, and there is no indication of active exploitation.
RemediationAI
Vendor-released patch: Instatic 0.0.21, which includes PR #626 ('fix(ai): read tools and the MCP relay decide row access with the HTTP rules'), supported by PR #625 for the author-reassignment row-access boundary and PR #335 for the @own-created contentAccess marker on plugin-created tables; upgrade installs and the ghcr.io/corebunch/instatic container image to 0.0.21 or later per the release notes at https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21 and the advisory at https://github.com/CoreBunch/Instatic/security/advisories/GHSA-x5cc-8486-8qqx. Where upgrading must be staged, the practical compensating controls are to stop exposing the /_instatic/mcp endpoint at the reverse proxy or firewall so JSON-RPC tool calls cannot reach the AI relay, revoke existing MCP access tokens and withhold the ai.chat and content.edit.own capabilities from low-privileged roles, at the cost of disabling AI assistant and MCP integrations for those users until the patch is applied; note that the vendor's complete fix is the 0.0.21 upgrade, since the missing check is in the tool code itself, and the assessed exposure is read-only disclosure of other users' rows in the same instance rather than any write or deletion.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Instatic is a self-hosted content and site builder that exposes both a conventional admin HTTP API (/admin/api/cms/data/rows/...) and an AI layer whose tools are published over a Model Context Protocol relay at /_instatic/mcp. The flaw is a missing object-level authorization check (CWE-862, mapped by the reporter to CWE-639 and CWE-863): the capability gate in server/ai/tools/capabilityGate.ts verifies that a principal holds a required capability such as content.edit.own, but it never determines whether that principal may touch a specific table or row. In server/ai/tools/content/readTools.ts, content_get_document calls getDataRow(ctx.db, ctx.branch, documentId) and content_list_documents calls listDataRows(ctx.db, ctx.branch, args.tableId) and returns the results unfiltered, so an own-scoped principal receives rows authored by other users, including unpublished drafts and system tables. Because the MCP registry exposes these read tools to any token carrying content.edit.own, the MCP surface becomes a parallel path around the row-access boundary that the HTTP data-row route applies; the assessed impact is confidentiality-only (high) with no integrity or availability effect, and the attack is reachable over the network by an authenticated low-privileged principal. Deployments that do not expose the AI/MCP tool surface are not affected.
Know when Instatic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Remote MCP endpoint, low complexity, requires a low-privileged authenticated token (PR:L), no UI; impact is cross-user read-only disclosure so C:H and I:N/A:N, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.
Executive ViewAI
A high-severity vulnerability in Instatic (versions before 0.0.21) allows any authenticated user with basic content editing and AI chat permissions to access other users' private drafts and system table data. This unauthorized access could lead to data breaches and privacy violations, affecting content confidentiality across the organization. Leadership should prioritize patching to prevent potential insider threats or accidental exposure of sensitive information.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB