Threats tagged 'ghsa-5mp9-m5x3-58qj'

Instatic versions before 0.0.21 have an authorization bypass vulnerability in the handleRowAuthor function. Authenticated users with the content.edit.any permission but without data.system.tables.read can exploit this flaw by sending PATCH requests to the /admin/api/cms/data/rows/:id/author endpoint. This allows them to read system-table rows and reassign their authors by bypassing table-level access controls.