PULSE
ES
FEED
ransomqilin reclama a Arthur Chapman Kettering Smetak Pikala PA · US · Professional Servicesransomakira reclama a Bison Bag · Retail & E-Commerceransomakira reclama a SK Global Software · KR · Technologyransomakira reclama a Pelham Plastics · Manufacturingransomsilentransomgroup reclama a G... R...ransombooba project reclama a Boardman Park · GB · Otherransombooba project reclama a Vetstoria · SE · Healthcareransombooba project reclama a City of Edgewater · US · Government & Defenseransombooba project reclama a DROUIN SAS · FR · Manufacturingransomn0n reclama a Company #127 · SAransomn0n reclama a Company #126ransomn0n reclama a Company #125 · USransomn0n reclama a Company #124 · USransomn0n reclama a Company #123 · USransomqilin reclama a Arthur Chapman Kettering Smetak Pikala PA · US · Professional Servicesransomakira reclama a Bison Bag · Retail & E-Commerceransomakira reclama a SK Global Software · KR · Technologyransomakira reclama a Pelham Plastics · Manufacturingransomsilentransomgroup reclama a G... R...ransombooba project reclama a Boardman Park · GB · Otherransombooba project reclama a Vetstoria · SE · Healthcareransombooba project reclama a City of Edgewater · US · Government & Defenseransombooba project reclama a DROUIN SAS · FR · Manufacturingransomn0n reclama a Company #127 · SAransomn0n reclama a Company #126ransomn0n reclama a Company #125 · USransomn0n reclama a Company #124 · USransomn0n reclama a Company #123 · US
← All CVEs
CVE WatchNov 3, 2026

CVE-2026-121458

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authentica

CVSS

6.5

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 3, 2026 · Last modified: Nov 3, 2026 · CWE-862

EPSS · 30d

Not enough EPSS history yet.

Technical description

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-970724.3 MED
—
———Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.6hCVE-2026-397774.3 MED
—
———Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.6hCVE-2026-397435.3 MED
—
———Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.6hCVE-2026-1208465.3 MED
—
———Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 7.7.1.6hCVE-2026-1195095.3 MED
—
———Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0.6hCVE-2026-1194955.3 MED
—
———Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2.6h