Skip to content
OpenAdvisories

Package · npm

studiocms

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Low 2.7
    CVE-2026-32638

    StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the attacker-controlled `rank` query parameter to decide whether owner accounts should be filtered from t…

    withstudiocms studiocms studiocms npm
  • Medium 5.4
    CVE-2026-32104

    StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferences. It checks that t…

    withstudiocms studiocms studiocms npm
  • Medium 4.7
    CVE-2026-32106

    StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comp…

    withstudiocms studiocms studiocms npm
  • Medium 6.8
    CVE-2026-32103

    StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any …

    withstudiocms studiocms studiocms npm
  • High 7.1
    CVE-2026-30945 Public exploit

    StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any …

    withstudiocms studiocms studiocms npm
  • High 8.8
    CVE-2026-30944 Public exploit

    StudioCMS Affected by Privilege Escalation via Insecure API Token Generation

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner …

    withstudiocms studiocms studiocms npm
  • Medium 6.5
    CVE-2026-24134 Public exploit

    StudioCMS has an Authorization Bypass Through User-Controlled Key

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to acce…

    withstudiocms studiocms studiocms npm