HIGH 7.1 NVD
CVE-2026-119707
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. A
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.
References
- https://github.com/SonicJs-Org/sonicjs
- https://github.com/SonicJs-Org/sonicjs/blob/v3.0.0/packages/core/src/routes/api.ts#L1296
- https://github.com/SonicJs-Org/sonicjs/issues/1125
- https://github.com/SonicJs-Org/sonicjs/pull/1147
- https://hackmd.io/@hieuPenguinnn/sonicjs-content-api-write-acl-bypass
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.