https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T01:19:12.499274+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-125398 fkie_cve-2026-125398 2026-11-11T01:19:12.501617+00:00

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.

 https://db.gcve.eu/vuln/ghsa-5mp9-m5x3-58qj GHSA-5mp9-m5x3-58qj 2026-11-11T01:19:12.501737+00:00

Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.