Threats affecting pkg:github/Instatic

Instatic versions before 0.0.21 have a missing authorization vulnerability in the AI/MCP content read tools. This flaw allows low-privileged authenticated users with specific capabilities to access data rows belonging to other users by bypassing object-level authorization checks. Exploitation can lead to unauthorized access to private or unpublished draft content and enumeration of posts system table rows, resulting in cross-user data disclosure.