TI-2026-83182 Aliases CVE-2026-119707 GHSA-4392-9339-gxp5

Missing authorization in SonicJS content write API

MEDIUM 64CWE-862Published 2026-10-30 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

SonicJS through 3.0.0 has a missing authorization flaw in its /api/:collection and /api/content write routes, which check only coarse role labels (CWE-862). Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document access control lists and administrator deny overrides.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00307 23rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SonicJs-Org	sonicjs	up to 3.0.0	—	No fix listed	CNA

sonicjs VendorSonicJs-Org Affected up to 3.0.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for sonicjs.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

2026-10-30 Threatist record created from CVE-2026-119707
2026-10-30 Alias added: GHSA-4392-9339-gxp5
2026-11-01 Priority changed: MEDIUM → LOW
2026-11-04 CISA SSVC decision points changed
2026-11-04 Priority changed: LOW → MEDIUM

References

Patch 1

https://github.com/SonicJs-Org/sonicjs/pull/1147

Advisory 1

https://hackmd.io/@hieuPenguinnn/sonicjs-content-api-write-acl-bypass

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences