Threats affecting pkg:npm/sonicjs

SonicJS versions up to 3.0.0 have a missing authorization vulnerability in certain API write routes. Authenticated users with author or editor roles can bypass document access controls and administrator restrictions to create, modify, publish, or soft-delete documents belonging to other users. This occurs because the API only checks coarse role labels rather than fine-grained permissions.