What happened
The AI/MCP content-read tools in Instatic skip the per-object authorization enforced by the regular HTTP API, so a user with ai.chat/content.edit.own scopes can call content_get_document and content_list_documents to read other users' rows. CVSS 6.5 (3.1) / 7.1 (4.0), published 2026-11-03; CISA SSVC marks exploitation 'none'.
Why it matters
Instatic exposes an AI/MCP interface over an LLM-accessible tool surface. The missing object-level authorization means an agent (or the user driving it) can enumerate and read other users' private or unpublished content via the MCP channel — an authorization-boundary bypass that the normal API checks against.
Attack vector
Missing authorization (CWE-862) in the AI/MCP content-read tools: content_get_document and content_list_documents do not enforce the object-level authorization checks applied by the normal HTTP API. A low-privileged user can pass a cross-user document/table reference over the MCP interface to read data belonging to other users.
Affected systems
Instatic (CoreBunch/Instatic) before 0.0.21
Mitigation
Upgrade to Instatic v0.0.21. Advisory: https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21 and GHSA-x5cc-8486-8qqx