Instatic vulnerabilities

CVEs whose affected-version data names the Instatic package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-121458Medium· 6.5

5d ago

Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other u…

▾ SunlitCoreBunch · InstaticEPSS 0.31%via CVEORG