7.1
HighCVSS 3.1 · from VulnCheck
CVE-2026-119707
SonicJS through 3.0.0 Missing Authorization in Content Write API
sonicjs · Missing authorization · CWE-862Affectedsonicjs
FixA patch is linked in the references.
PublishedOct 30, 15:16 · VulnCheck
ScoredOct 30 · 7.1 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can change data. CVSS impact.
Description
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed insonicjsup to 3.0.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known