Threats tagged 'ghsa-wq53-554h-vq3f'

Instatic versions before 0.0.21 have a missing authorization vulnerability in their AI/MCP content read tools. This flaw allows low-privileged authenticated users with specific capabilities to access data belonging to other users by bypassing object-level authorization checks. Exploitation can lead to unauthorized disclosure of private or unpublished draft content and enumeration of posts system table rows.