PT-2026-24253 · Studiocms · Studiocms

Filipegaudard · Published 2026-03-10 · Updated 2026-03-17 · CVE-2026-30945

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions StudioCMS versions prior to 0.4.0

Description StudioCMS is a server-side-rendered, Astro native, headless content management system. The DELETE /studiocms api/dashboard/api-tokens API endpoint, before version 0.4.0, allows authenticated users with editor privileges or higher to revoke API tokens belonging to any user, including administrator and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This can lead to a targeted denial of service against critical integrations and automations.

Recommendations Update to version 0.4.0 or later.

Exploit

Fix

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-863

Related Identifiers

CVE-2026-30945

GHSA-8RGJ-VRFR-6HQR

Affected Products

Studiocms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30945.json · Exploit
• https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8rgj-vrfr-6hqr · Vendor Advisory
• https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-30945 · Security Note
• https://osv.dev/vulnerability/GHSA-8rgj-vrfr-6hqr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30945 · Vendor Advisory
• https://github.com/withstudiocms/studiocms · Note
• https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0 · Note
• https://twitter.com/CVEnew/status/2033994306747568481 · Twitter Post