CVE-2026-30944

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID, resulting in a full privilege escalation. This vulnerability is fixed in 0.4.0.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441	Patch
https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0	Product
https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4	Vendor Advisory Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:studiocms:studiocms:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-10 18:18

Updated : 2026-03-17 16:14

NVD link : CVE-2026-30944

Mitre link : CVE-2026-30944

CVE.ORG link : CVE-2026-30944

JSON object : View

Products Affected

studiocms

studiocms

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-863

Incorrect Authorization

{"id": "CVE-2026-30944", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2026-03-10T18:18:54.260", "references": [{"url": "https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4", "tags": ["Vendor Advisory", "Exploit"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID, resulting in a full privilege escalation. This vulnerability is fixed in 0.4.0."}, {"lang": "es", "value": "StudioCMS es un sistema de gesti\u00f3n de contenido sin cabeza, nativo de Astro y renderizado en el lado del servidor. Antes de 0.4.0, el endpoint /studiocms_api/dashboard/api-tokens permite a cualquier usuario autenticado (al menos Editor) generar tokens de API para cualquier otro usuario, incluyendo cuentas de propietario y administrador. El endpoint no valida si el usuario solicitante est\u00e1 autorizado para crear tokens en nombre del ID de usuario objetivo, lo que resulta en una escalada de privilegios completa. Esta vulnerabilidad se corrige en 0.4.0."}], "lastModified": "2026-03-17T16:14:35.723", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:studiocms:studiocms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "087DD76D-B0EE-4D64-BDDD-9EDC994C5F1F", "versionEndExcluding": "0.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}