Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2026-30944 EUVD-2026-10555GHSA-667w-mmh7-mrr4

StudioCMS Affected by Privilege Escalation via Insecure API Token Generation

Published Mar 10, 2026 · Updated Mar 10, 2026 · Assigned by GitHub_M

Vendor: withstudiocms Product: studiocms Package: studiocms Ecosystem: npm

Description

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID, resulting in a full privilege escalation. This vulnerability is fixed in 0.4.0.

Affected products

VendorProductAffectedFixed
withstudiocms studiocms < 0.4.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm studiocms < 0.4.0 0.4.0 GHSA-667w-mmh7-mrr4

References