{"id":"CVE-2026-119707","title":"SonicJS through 3.0.0 Missing Authorization in Content Write API","summary":"SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, mo…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cvssSource":"cna","cwe":["CWE-862"],"vendor":"SonicJs-Org","product":"sonicjs","affected":["sonicjs <= 3.0.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T22:52:34.362357Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-11-04","sourceUpdated":"2026-11-04T22:52:57.695Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119707","references":[{"url":"https://github.com/SonicJs-Org/sonicjs/issues/1125","label":"GitHub Issue #1125"},{"url":"https://github.com/SonicJs-Org/sonicjs"},{"url":"https://github.com/SonicJs-Org/sonicjs/blob/v3.0.0/packages/core/src/routes/api.ts#L1296"},{"url":"https://github.com/SonicJs-Org/sonicjs/pull/1147"},{"url":"https://hackmd.io/@hieuPenguinnn/sonicjs-content-api-write-acl-bypass"},{"url":"https://www.vulncheck.com/advisories/sonicjs-through-3.0.0-missing-authorization-in-content-write-api","label":"VulnCheck Advisory: SonicJS through 3.0.0 Missing Authorization in Content Write API"}],"tags":["cve.org","exploit-available"],"epss":0.00307,"epssPercentile":0.23627,"ingestedAt":"2026-11-05T21:36:00.664Z","slug":"CVE-2026-119707","body":"## Overview\n\nSonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.\n\n## Affected\n\n- `sonicjs <= 3.0.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}