HIGH8.8npm
GHSA-667w-mmh7-mrr4· CVE-2026-30944StudioCMS has Privilege Escalation via Insecure API Token Generation
Modified: 3/10/2026
package
npm/studiocms
pkg:npm/studiocms
MEDIUM6.5npm
GHSA-8cw6-53m5-4932· CVE-2026-24134StudioCMS has Authorization Bypass Through User-Controlled Key
Modified: 2/3/2026
HIGH7.1npm
GHSA-8rgj-vrfr-6hqr· CVE-2026-30945StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service
Modified: 3/13/2026
MEDIUM5.4npm
GHSA-9v82-xrm4-mp52· CVE-2026-32104StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings
Modified: 3/14/2026
MEDIUM6.8npm
GHSA-h7vr-cg25-jf8c· CVE-2026-32103StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation
Modified: 3/14/2026
MEDIUM4.7npm
GHSA-wj56-g96r-673q· CVE-2026-32106StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts
Modified: 3/14/2026
LOW2.7npm
GHSA-xvf4-ch4q-2m24· CVE-2026-32638StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
Modified: 3/18/2026