---
id: CVE-2026-119707
title: SonicJS through 3.0.0 Missing Authorization in Content Write API
summary: >-
  SonicJS through 3.0.0 contains a missing authorization vulnerability in the
  /api/:collection and /api/content write routes that only check coarse role
  labels. Authenticated authors or editors can use a bearer JWT or API key to
  create, mo…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-862
vendor: SonicJs-Org
product: sonicjs
affected:
  - sonicjs <= 3.0.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T22:52:34.362357Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:52:57.695Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119707'
references:
  - url: 'https://github.com/SonicJs-Org/sonicjs/issues/1125'
    label: 'GitHub Issue #1125'
  - url: 'https://github.com/SonicJs-Org/sonicjs'
  - url: >-
      https://github.com/SonicJs-Org/sonicjs/blob/v3.0.0/packages/core/src/routes/api.ts#L1296
  - url: 'https://github.com/SonicJs-Org/sonicjs/pull/1147'
  - url: 'https://hackmd.io/@hieuPenguinnn/sonicjs-content-api-write-acl-bypass'
  - url: >-
      https://www.vulncheck.com/advisories/sonicjs-through-3.0.0-missing-authorization-in-content-write-api
    label: >-
      VulnCheck Advisory: SonicJS through 3.0.0 Missing Authorization in Content
      Write API
tags:
  - cve.org
  - exploit-available
epss: 0.00307
epssPercentile: 0.23627
ingestedAt: '2026-11-05T21:36:00.664Z'
---

## Overview

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.

## Affected

- `sonicjs <= 3.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.