Threats tagged 'ghsa-4392-9339-gxp5'

SonicJS versions through 3.0.0 have a missing authorization vulnerability in certain API write routes. Authenticated users with author or editor roles can bypass document access controls and administrator restrictions to create, modify, publish, or soft-delete documents belonging to other users. This occurs because the API only checks coarse role labels rather than fine-grained permissions.