CoreBunch vulnerabilities

Products

• Instatic 3

Latest CoreBunch CVEs

Newest publication first

1. CVE-2026-125398 Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint

   Published 2026-11-09

   High·CVSS 7.1 EPSS 0.28%

   Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.t...

2. CVE-2026-121458 Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

   Published 2026-11-03

   High·CVSS 7.1 EPSS 0.31%

   Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and co...

3. CVE-2026-72587 Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint

   Published 2026-08-10

   Medium·CVSS 6.1 EPSS 0.32%

   A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.