CVE-2026-121458 in Instatic
Summary
by MITRE • 11/03/2026
Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Instatic versions prior to 0.0.21 represents a critical failure in object-level authorization controls within its AI Model Context Protocol implementation. This flaw specifically affects the tools designed for reading content via the MCP interface, namely content_get_document and content_list_documents. While the standard HTTP API of the application correctly enforces strict access control policies that verify whether an authenticated user has permission to view specific data rows, these same security checks are absent in the MCP endpoints. Consequently, any user who possesses basic authentication credentials along with the ai.chat and content.edit.own capabilities can bypass the intended isolation mechanisms. The core technical flaw lies in the inconsistent implementation of authorization logic across different interface layers; while the web-based API adheres to secure design principles by validating ownership or explicit permissions for each data object, the MCP layer operates under an overly permissive assumption that authenticated users with editing rights should have broad read access without verifying specific row-level ownership.
This architectural inconsistency allows low-privileged attackers to perform unauthorized cross-user data disclosure operations. By invoking content_get_document and content_list_documents through the MCP interface, malicious actors can retrieve private documents or unpublished drafts belonging to other users within the same tenant environment. The impact extends beyond simple information leakage; it enables systematic enumeration of rows from the posts system table, effectively allowing attackers to map out the internal data structure and identify sensitive records that were not intended for their access level. This capability undermines the fundamental security principle of least privilege, as users are granted more extensive read permissions than necessary for their role or assigned capabilities. The ability to enumerate unpublished content also poses a significant risk to intellectual property and confidential business communications stored within the platform.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically highlighting failures in enforcing object-level authorization checks. It is further categorized under CWE-639 Authorization Bypass Through User-Controlled Key if the system relies on predictable identifiers that are not validated against user ownership before retrieval. In terms of offensive security tactics, this behavior corresponds to ATT&CK technique T1078 Valid Accounts and potentially T1530 Data from Cloud Storage Object Discovery, as attackers leverage legitimate credentials to access resources outside their authorized scope. The exploitation path is straightforward for any authenticated user with the specified capabilities, requiring no complex payload construction or privilege escalation steps beyond normal API interaction patterns.
To mitigate this vulnerability, immediate patching to version 0.0.21 or later is required, as these updates include the necessary fixes to enforce consistent authorization checks across all interfaces. For organizations unable to upgrade immediately, implementing a reverse proxy or gateway that intercepts MCP traffic can provide temporary relief by applying additional access control policies before requests reach the application backend. Security teams should also audit existing API implementations to ensure that no other endpoints suffer from similar discrepancies between HTTP and alternative interface layers. Regular security assessments focusing on object-level authorization consistency are recommended to prevent recurrence of such cross-service privilege escalation flaws in future development cycles.