CoreBunch Instatic up to 0.0.20 AI/MCP Content Read Tools content_get_document/content_list_documents improper authorization

Summaryinfo

A vulnerability described as problematic has been identified in CoreBunch Instatic up to 0.0.20. This impacts the function content_get_document/content_list_documents of the component AI/MCP Content Read Tools. Such manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-121458. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in CoreBunch Instatic up to 0.0.20. Affected by this issue is the function content_get_document/content_list_documents of the component AI/MCP Content Read Tools. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality. CVE summarizes:

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-121458 since 11/03/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

Upgrading to version 0.0.21 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• CoreBunch

Name

• Instatic

Version

• 0.0.1
• 0.0.2
• 0.0.3
• 0.0.4
• 0.0.5
• 0.0.6
• 0.0.7
• 0.0.8
• 0.0.9
• 0.0.10
• 0.0.11
• 0.0.12
• 0.0.13
• 0.0.14
• 0.0.15
• 0.0.16
• 0.0.17
• 0.0.18
• 0.0.19
• 0.0.20

Website

• Product: https://github.com/CoreBunch/Instatic/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion