CVE-2026-119707EUVD-2026-114112GHSA-4392-9339-GXP5
SonicJS through 3.0.0 Missing Authorization in Content Write API
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
SonicJS, a content management system, is affected by a missing authorization flaw in its content write API. Logged-in authors and editors can exploit it to create, change, publish, or delete content belonging to other users, bypassing document access controls and administrator restrictions.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- SonicJs-Org sonicjs
through 3.0.0