CVE-2026-119707— SonicJS through 3.0.0 Missing Authorization in Content Write API

Quick assessment

Affected

SonicJs-Org sonicjs

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SonicJS 3.0.0 及更早版本在和写路由中存在缺少授权（missing authorization）的漏洞，这些路由仅检查粗略的角色标签。经过身份验证的作者或编辑者可以利用 Bearer JWT 或 API 密钥创建、修改、发布或软删除其他用户的文档，从而绕过文档访问控制列表（ACL）和管理员的拒绝覆盖策略。

CVSS 7.1 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1551 T1133 · External Remote Services T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SonicJS through 3.0.0 Missing Authorization in Content Write API

Source: CVE Program / CVE List V5

Vulnerability Description

SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
SonicJs-Org	sonicjs	0 ~ 3.0.0	-

II. Public POCs for CVE-2026-119707

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119707

请登录查看更多情报信息。

Other References for CVE-2026-119707 (6)

https://github.com/SonicJs-Org/sonicjs/blob/v3.0.0/packages/core/src/routes/api.ts#L1296 technical-description
https://github.com/SonicJs-Org/sonicjs product
https://hackmd.io/@hieuPenguinnn/sonicjs-content-api-write-acl-bypass third-party-advisory
https://github.com/SonicJs-Org/sonicjs/pull/1147 patch issue-tracking
https://github.com/SonicJs-Org/sonicjs/issues/1125 issue-tracking
https://www.vulncheck.com/advisories/sonicjs-through-3.0.0-missing-authorization-in-content-write-api third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119707

IV. Related Vulnerabilities

Same weakness: CWE-862