CVE-2026-121458

Instatic AI content tools bypass the HTTP ownership boundary

CoreBunch · Instatic AI/MCP content read tools

First documented disclosure · Review checkpoint

Summary

An own-content user can read another user’s drafts through tools that omit row authorization.

Severity and exploitation evidence

High · 7.1/10 · CVSS 4.0. Severity source.

Exploitation not established: Reviewed disclosure and controlled research; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The AI read tools and MCP relay query repositories without the table and ownership checks applied by the normal HTTP endpoint.

Conditions required

Authenticated ai.chat and content.edit.own permissions. Direct MCP requests do not require an LLM provider.

Potential impact

Cross-user private draft and system-table row disclosure. The researcher used local accounts and data; third-party access was not tested.

Affected versions and configurations

Before 0.0.21; the advisory tested 0.0.20 and reports the behavior from 0.0.5.

Fix and mitigation status

0.0.21 restores common row/table authorization checks.

Practical next steps

Upgrade to 0.0.21 or a later supported release; test get, list and search using an own-content-only principal.

Operating lesson

Every agent tool must enforce the same object permissions as the corresponding application API.

Evidence and limits

The explicit public fix PR and 0.0.21 release were October 12; the detailed advisory and CNA were November 3. CNA 7.1 CVSS 4.0 is High; the original advisory’s 6.5 v3.1 is Moderate. These are two scoring versions of the same weakness.

Sources