The vulnerability is a missing authorization check in Instatic's AI/MCP content read tools. Before version 0.0.21, authenticated users with the ai.chat and content.edit.own capabilities could invoke content_get_document and content_list_documents via the MCP interface, bypassing object‑level checks normally enforced by the HTTP API. This flaw permits the attacker to retrieve private or unpublished draft content and enumerate rows from the posts table, exposing data belonging to other users.

Vendors impacted are CoreBunch—Instatic. All installations running Instatic older than version 0.0.21 are vulnerable. No specific patch versions are listed beyond the release note, but upgrading to 0.0.21 or later resolves the issue.

The flaw carries a CVSS score of 7.1, indicating a moderate‑to‑high threat. Exploitation requires only authenticated access with ai.chat and content.edit.own permissions, which can be granted to low‑privileged users. There is no published exploit, and the vulnerability is not listed in CISA’s KEV catalog. Because EPSS data is not available, the exact likelihood of exploitation cannot be quantified, but the absence of mitigation controls makes it a realistic risk for any environment that grants publish capabilities to users.