SZB-5849a1e4d5
EUVD flags missing authorization in SonicJS through 3.0.0 (CVSS 7.1)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- SonicJS
- Product
- SonicJS
- First seen
Summary
The EUVD (ENISA) database has published EUVD-2026-114112 for SonicJS through 3.0.0. It describes write routes that check only coarse role labels, which could let authenticated authors or editors create, modify, or publish content beyond their permissions.
If you use SonicJS
Upgrade SonicJS to a version later than 3.0.0 once a fix is released
Audit API keys and bearer tokens issued to authors and editors
Review recently created or published content for unauthorized changes
What the sources say 1
· Mastodon: “SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels.” Source