Description
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SonicJs-Org sonicjs
Default version status: unaffected
0 to ≤ 3.0.0affected
pkg:npm/%40sonicjs-cms/coreReferences
- https://github.com/SonicJs-Org/sonicjs/issues/1125 ↗
- https://github.com/SonicJs-Org/sonicjs ↗
- https://github.com/SonicJs-Org/sonicjs/blob/v3.0.0/packages/core/src/routes/api.ts#L1296 ↗
- https://github.com/SonicJs-Org/sonicjs/pull/1147 ↗
- https://hackmd.io/@hieuPenguinnn/sonicjs-content-api-write-acl-bypass ↗
- https://www.vulncheck.com/advisories/sonicjs-through-3.0.0-missing-authorization-in-content-write-api ↗