PT-2026-24253 · Studiocms · Studiocms

Filipegaudard · Publicado 2026-03-10 · Atualizado 2026-03-17 · CVE-2026-30945

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions StudioCMS versions prior to 0.4.0

Description StudioCMS is a server-side-rendered, Astro native, headless content management system. The DELETE /studiocms api/dashboard/api-tokens API endpoint, before version 0.4.0, allows authenticated users with editor privileges or higher to revoke API tokens belonging to any user, including administrator and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This can lead to a targeted denial of service against critical integrations and automations.

Recommendations Update to version 0.4.0 or later.

Exploit

Correção

IDOR

Incorrect Authorization

Enumeração de Fraquezas

CWE-639

CWE-863

Identificadores relacionados

CVE-2026-30945

GHSA-8RGJ-VRFR-6HQR

Produtos afetados

Studiocms

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30945.json · Exploit
• https://github.com/withstudiocms/studiocms · Nota
• https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8rgj-vrfr-6hqr · Aviso do Fabricante
• https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3 · Correção
• https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0 · Nota
• https://twitter.com/CVEnew/status/2033994306747568481 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-30945 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8rgj-vrfr-6hqr · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-30945 · Aviso do Fabricante