CVE-2026-119707
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.
Risk Assessment
A low-privileged user can modify or delete other users' content, leading to data integrity violations and bypass of access policies. This may result in unauthorized publications or data loss.
Recommendation
Update SonicJS to a version containing the fix or enforce additional document-level authorization checks on write routes. Until then, restrict API access and monitor author and editor activity.
Other vulnerabilities in SonicJS
Original NVD description (English source)
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS