Studiocms
CVE-2026-30945
HIGH
GHSA-8rgj-vrfr-6hqr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as editor-level user
-
ExploitCraft DELETE request with arbitrary userID
-
ExecutionRevoke admin API tokens
-
ImpactDisable critical integrations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Attacker must have editor privileges or above in StudioCMS prior to version 0.4.0. Vulnerable endpoint DELETE /studiocms_api/dashboard/api-tokens accepts userID parameter without ownership verification, allowing token revocation across user accounts. |
| Impact | CVSS 7.1 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication. |
| Exploit ScenarioDerived | An attacker (requires authentication) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
StudioCMS prior to version 0.4.0 allows authenticated editors and above to revoke API tokens belonging to any user, including administrators and owners, due to insufficient authorization checks on the DELETE /studiocms_api/dashboard/api-tokens endpoint. An attacker with editor privileges can exploit this to disable critical integrations and automations by revoking tokens of higher-privileged accounts. No patch is currently available for affected versions.
Earlier versions of this analysis (1)
headless content management system. versions up to 0.4.0 is affected by authorization bypass through user-controlled key (CVSS 7.1).
RemediationAI
Fixed in version 0.4.0.. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) exists in the and owner accounts. The component. StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against c
Know when Studiocms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations. This vulnerability is fixed in 0.4.0.
Executive ViewAI
StudioCMS instances running versions prior to 0.4.0 face a critical privilege escalation vulnerability where authenticated editors can revoke API tokens of administrators and owners, potentially disrupting system access and administrative functions. This poses a significant risk to organizations relying on StudioCMS for content management, as malicious insiders or compromised editor accounts could disable critical integrations and administrative access.
Implement Web Application Firewall (WAF) rules to block DELETE requests to /studiocms_api/dashboard/api-tokens endpoint from non-owner accounts; use network segmentation to restrict editor account capabilities; disable the API token management feature entirely if not actively required; implement comprehensive audit logging and alerting on token revocation events; rotate all administrative API tokens immediately and restrict token creation to owner-level accounts only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in StudioCMS Authorization Bypass Vulnerabilities
View all 2High severity vulnerability in StudioCMS. The S3 storage manager's `isAuthorized()` function is declared `async` (return
Medium severity vulnerability in StudioCMS. The POST /studiocms_api/dashboard/create-reset-link endpoint allows any auth
headless content management system. versions up to 0.2.0 is affected by authorization bypass through user-controlled key
A security vulnerability in StudioCMS (CVSS 5.4). Remediation should follow standard vulnerability management procedures
## Summary The REST API `createUser` endpoint uses string-based rank checks that only block creating `owner` accounts,
Exploit-DB