Skip to content
OpenAdvisories
High · 7.1 Public exploit CVE-2026-30945 EUVD-2026-10557GHSA-8rgj-vrfr-6hqr

StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

Published Mar 10, 2026 · Updated Mar 10, 2026 · Assigned by GitHub_M

Vendor: withstudiocms Product: studiocms Package: studiocms Ecosystem: npm

Description

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations. This vulnerability is fixed in 0.4.0.

Affected products

VendorProductAffectedFixed
withstudiocms studiocms < 0.4.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm studiocms < 0.4.0 0.4.0 GHSA-8rgj-vrfr-6hqr

References