Is CVE-2026-125398 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125398 being exploited in the wild.

How severe is CVE-2026-125398?

High severity, with a CVSS score of 7.1, published 10 November 2026.

Which products and versions are affected?

CoreBunch Instatic before 0.0.21.

Is there a fix for CVE-2026-125398?

Yes: fixed in 0.0.21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-125398 attacked?

It is attacked over the network.

Am I affected by CVE-2026-125398?

Check whether you run CoreBunch Instatic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125398: Instatic authorization bypass in handleRowAuthor

CVE-2026-125398 · Severity: high · CVSS 7.1 · Published 2026-11-10

Instatic is a content management system that controls access to database tables through permission checks. Authenticated users with content editing privileges but without system-table read permissions could bypass access controls to read restricted data from system tables (such as unpublished content) and reassign row authorship. This allows privilege escalation within the application to access sensitive information that should be protected.

Technologies: CoreBunch Instatic. Vendors: CoreBunch.

Quick answers

Is CVE-2026-125398 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125398 being exploited in the wild.
How severe is CVE-2026-125398?: High severity, with a CVSS score of 7.1, published 10 November 2026.
Which products and versions are affected?: CoreBunch Instatic before 0.0.21.
Is there a fix for CVE-2026-125398?: Yes: fixed in 0.0.21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125398 attacked?: It is attacked over the network.
Am I affected by CVE-2026-125398?: Check whether you run CoreBunch Instatic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.0.21

Technical details

The PATCH /admin/api/cms/data/rows/:id/author endpoint performed a bare getDataRow() call instead of the access-controlled loadRowForAccess() function, allowing users to load and modify rows they lack permission to read. An attacker with content.edit.any permission but without data.system.tables.read could retrieve full system-table row contents and reassign authors via this endpoint, while direct GET requests correctly returned 404. The fix replaces getDataRow() with loadRowForAccess() to enforce the same ownership and table-family boundary checks used in other row write operations.

Affected products

CoreBunch Instatic before 0.0.21

Timeline

2026-11-10: disclosed
2026-11-10: patched: Fixed in version 0.0.21 via commit ff1e51e

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.