Skip to content
OpenAdvisories

Package · npm

studiocms

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-30945 Public exploit

    StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any …

    withstudiocms studiocms studiocms npm
  • High 8.8
    CVE-2026-30944 Public exploit

    StudioCMS Affected by Privilege Escalation via Insecure API Token Generation

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner …

    withstudiocms studiocms studiocms npm