The report
A user denied access to another author's draft through the HTTP endpoint could request the same content through Instatic's MCP interface and receive it. In the disclosed two-principal test, HTTP returned a not-found response, while content_get_document returned a private row. The Instatic security advisory also identifies content list and search methods capable of enumerating material the user did not own.
Different entrances to the same data
The low-privilege account had permissions for AI chat and editing its own content, not the permission to edit arbitrary authors' content. Under the reported implementation, the normal web read path enforced ownership but backend data helpers reachable from MCP tools did not consistently apply the same restriction. The security error therefore occurred after a legitimate tool was selected, at the record fetch itself.
The distinction matters for agent deployments. A model does not need to be persuaded to ignore instructions, and a hostile user does not need to bypass the model's reasoning, if the exposed MCP operation already returns unauthorized content on a direct call. A guard that judges the text of an agent's prompt would not repair this missing ownership check.
The advisory identifies the affected branch through 0.0.20 and the fix in 0.0.21. It describes a controlled reproduction, not confirmed disclosure of real customers' drafts. The reported canary establishes that the response crossed an access boundary; it does not establish how many production users were exposed.
Test authorization where data is retrieved
The useful regression is one object belonging to user A, then user B attempting HTTP read, MCP get, MCP list and MCP search with identical credentials. Each route should enforce the same ownership rule at the underlying data-access layer. Repeating only the normal web request would miss the demonstrated failure. Underlying disclosure and technical scope remain linked to the canonical Case.