Skip to content
OpenAdvisories

Vendor

withstudiocms

7 known vulnerabilities.

withstudiocms at a glance

Last 12 months
7
Critical · all time
0
Exploited · all time
0
Public exploit · all time
3
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 6 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202660
Feb 202600
Jan 202610
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

studiocms 7
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Low 2.7
    CVE-2026-32638

    StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the attacker-controlled `rank` query parameter to decide whether owner accounts should be filtered from t…

    withstudiocms studiocms studiocms npm
  • Medium 5.4
    CVE-2026-32104

    StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferences. It checks that t…

    withstudiocms studiocms studiocms npm
  • Medium 4.7
    CVE-2026-32106

    StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comp…

    withstudiocms studiocms studiocms npm
  • Medium 6.8
    CVE-2026-32103

    StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any …

    withstudiocms studiocms studiocms npm
  • High 7.1
    CVE-2026-30945 Public exploit

    StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any …

    withstudiocms studiocms studiocms npm
  • High 8.8
    CVE-2026-30944 Public exploit

    StudioCMS Affected by Privilege Escalation via Insecure API Token Generation

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner …

    withstudiocms studiocms studiocms npm
  • Medium 6.5
    CVE-2026-24134 Public exploit

    StudioCMS has an Authorization Bypass Through User-Controlled Key

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to acce…

    withstudiocms studiocms studiocms npm