AI/MCP content tools returned material denied by the standard HTTP read route to the same low-privilege user. Entry and authority. An affected Instatic 0.0.20 deployment provides AI/MCP access to a user without content.edit.any authority. Observed mechanism and consequence. Content get/list/search operations lacked the same object ownership checks as HTTP…
Inspect the ClaimsCase · DiggingBeagle record
Instatic MCP content tools bypassed private-draft authorization
AI/MCP content tools returned material denied by the standard HTTP read route to the same low-privilege user.
Public disclosure: Nov 9, 2026
Scope
An affected Instatic 0.0.20 deployment provides AI/MCP access to a user without content.edit.any authority. Content get/list/search operations lacked the same object ownership checks as HTTP endpoints, creating an alternate reader path to private draft rows.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-INSTATIC-ACL; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-INSTATIC-MCP-ACL-01 · CLM-DB233-INSTATIC-MCP-ACL-02 · Instatic advisory: unauthorized private draft access through MCP content tools
At a glance
0.0.21 is reported fixed. The disclosure is a controlled reproduction; no actual affected customer access is established.
Limits and uncertaintyFull account
AI/MCP content tools returned material denied by the standard HTTP read route to the same low-privilege user.
Entry and authority. An affected Instatic 0.0.20 deployment provides AI/MCP access to a user without content.edit.any authority.
Observed mechanism and consequence. Content get/list/search operations lacked the same object ownership checks as HTTP endpoints, creating an alternate reader path to private draft rows.
Limits and status. 0.0.21 is reported fixed. The disclosure is a controlled reproduction; no actual affected customer access is established.
An Instatic account with permission to use AI tools but not to read another user's drafts could reach those drafts through MCP content operations. The ordinary HTTP document route denied the same access. The advisory traces the issue to backend data-layer functions that did not impose ownership checks consistently. This is an actual cross-interface authorization discrepancy in a controlled demonstration, not a published inventory of compromised customer drafts.
Mechanism and trust boundary
- 01
Precondition and trust context
An affected Instatic 0.0.20 deployment provides AI/MCP access to a user without content.edit.any authority.
- 02
Crossed boundary
Content get/list/search operations lacked the same object ownership checks as HTTP endpoints, creating an alternate reader path to private draft rows.
- 03
Observed limit
0.0.21 is reported fixed. The disclosure is a controlled reproduction; no actual affected customer access is established.
Timeline
- Nov 9, 2026Event type unspecified
Initial documented finding
Instatic MCP content tools bypassed private-draft authorization
- Nov 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-INSTATIC-MCP-ACL-01The advisory reports that AI/MCP content_get_document could return a private draft that the same principal could not fetch through normal HTTP.supported
Basis: reported finding
- supportsInstatic advisory: unauthorized private draft access through MCP content toolsprimary disclosure
Advisory Summary and Proof of Concept
CLM-DB233-INSTATIC-MCP-ACL-02The authorized scope also includes list and search paths that could enumerate another author’s content.supported
Basis: reported finding
- supportsInstatic advisory: unauthorized private draft access through MCP content toolsprimary disclosure
Advisory Details and other endpoints
Controls and mitigations
- Apply owner and role checks inside the shared data access layer used by both MCP and HTTP; upgrade to the reported corrected version.
- Reproduce read, list and search requests with two distinct users and private canary documents, including system records.
Unknowns and contradictions
- 0.0.21 is reported fixed. The disclosure is a controlled reproduction; no actual affected customer access is established.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235