This vulnerability in Instatic before version 0.0.21 is an authorization bypass that occurs in the handleRowAuthor endpoint. It lets any authenticated user who has content.edit.any permission but does not have data.system.tables.read permission retrieve system-table rows and change their associated author. Because the code loads rows using getDataRow() instead of the correct loadRowForAccess(), table‑level access checks are skipped. The primary impact is privilege escalation and data tampering, potentially compromising the confidentiality and integrity of system tables.

The affected product is CoreBunch Instatic, versions prior to 0.0.21. Impacted systems include any deployment of Instatic < 0.0.21 where users possess the content.edit.any permission. The fix is available in v0.0.21. The vulnerability is not listed in the CISA KEV catalog and EPSS data is unavailable.

The CVSS score of 7.1 indicates high severity. Because EPSS data is missing and the vulnerability is not in KEV, exploitation likelihood is uncertain, but no known public exploits are reported. Attackers only need authentication with content.edit.any permission and can target any row via the PATCH endpoint /admin/api/cms/data/rows/:id/author, so the risk of exploitation is high and should be mitigated promptly.