Missing Authorization Vulnerability in SonicJS API

CVE-2026-119707

What is CVE-2026-119707?

SonicJS versions up to 3.0.0 have a missing authorization vulnerability within its API that affects the /api/:collection and /api/content write routes. This flaw allows authenticated authors or editors with a bearer JWT or API key to create, modify, publish, or even soft-delete documents owned by other users. The vulnerability arises from inadequate checks on role labels, leading to potential bypass of document Access Control Lists (ACLs) and administrative deny overrides. This issue exposes sensitive content management functions and increases the risk of unauthorized access within the application.

References