Instatic: MCP read tools skip the checks the HTTP API enforces
Instatic's MCP content tools returned any user's private drafts, because they skipped the ownership checks its HTTP API applies.
· Instatic · Research by Sriman Aluvala
Instatic's AI and MCP content read tools skipped the object-level authorization checks its HTTP API applies, letting any user with chat and own-content rights read other users' private drafts. Fixed in 0.0.21; found by Sriman Aluvala.
01What happened
Sriman Aluvala reported an authorization bypass in Instatic's AI and MCP content read tools, and the CoreBunch/Instatic project published the advisory on November 3, 2026 with the fix in version 0.0.21. The reporter tested version 0.0.20 and traced the behaviour back to Instatic 0.0.5.
02How it works
The content_get_document, content_list_documents and content_search_documents tools reach the data layer without running the object-level checks that Instatic's HTTP data-row endpoint applies. content_get_document returns a row with no ownership test, and the list tool omits the ownership filter an own-only user needs. The capability gate asks only whether the caller holds a capability at all, not whether that caller may read the specific table or row.
03Who is affected
Instatic releases before 0.0.21 are affected on any deployment where a user holds the ai.chat and content.edit.own capabilities. No elevated capability such as content.edit.any or data.system.tables.read is needed, and the MCP endpoint can be called directly with no LLM provider configured.
04What to do
Upgrade Instatic to 0.0.21, which applies the HTTP row-access rules to the MCP relay and the AI read tools. Review who holds ai.chat on sites with more than one author, and treat private and unpublished drafts as already read by those users until the upgrade is done.
Sources 3 links, all fetched
- 1github.comInstatic Advisory
- 2github.comGitHub Advisory
- 3github.comInstatic 0.0.21