PT-2026-24252 · Studiocms · Studiocms

Filipegaudard · Published 2026-03-10 · Updated 2026-03-17 · CVE-2026-30944

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions StudioCMS versions prior to 0.4.0

Description StudioCMS is a server-side-rendered, Astro native, headless content management system. The /studiocms api/dashboard/api-tokens API endpoint, in versions prior to 0.4.0, does not properly validate authorization when creating API tokens. This allows any authenticated user with at least Editor privileges to generate API tokens for any other user, including those with Owner or Admin accounts. This can lead to a full privilege escalation. The vulnerable parameter is the user ID.

Recommendations Update to version 0.4.0 or later.

Exploit

Fix

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-863

Related Identifiers

CVE-2026-30944

GHSA-667W-MMH7-MRR4

Affected Products

Studiocms

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30944.json · Exploit
• 🔥 https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4 · Exploit
• https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441 · Patch
• https://osv.dev/vulnerability/GHSA-667w-mmh7-mrr4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30944 · Security Note
• https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.4.0 · Note
• https://github.com/withstudiocms/studiocms · Note
• https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3 · Note
• https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0 · Note
• https://twitter.com/CveFindCom/status/2031455384901206422 · Twitter Post
• https://twitter.com/TheHackerWire/status/2031440686747369659 · Twitter Post
• https://twitter.com/CVEnew/status/2033994307548713052 · Twitter Post