SonicJS versions up to and including 3.0.0 contain a missing authorization check in the /api/:collection and /api/content write routes. Only coarse role labels are verified, so an authenticated author or editor using a bearer JWT or API key can create, modify, publish, or soft‑delete documents belonging to any user. This bypasses per‑document ACLs and administrator deny overrides, exposing the integrity and confidentiality of all content and potentially enabling data tampering or disclosure of sensitive information.

The affected product is SonicJS, developed by SonicJs‑Org, with all releases up to version 3.0.0 impacted. No other vendor or product variant is listed.

The CVSS score of 7.1 indicates a high severity vulnerability. EPSS information is not available, and the issue is not listed in the CISA KEV catalog, suggesting no current widespread exploitation. The likely attack vector is via the HTTP API, requiring an authenticated author or editor account; an attacker who obtains such credentials could manipulate any document. Because any valid user with the appropriate role can perform the exploit, the risk is significant for organizations using unpatched SonicJS installations.