HIGH8.8npm
GHSA-667w-mmh7-mrr4· CVE-2026-30944StudioCMS has Privilege Escalation via Insecure API Token Generation
Modified: 3/10/2026
package
pkg:npm/studiocms
StudioCMS has Privilege Escalation via Insecure API Token Generation
Modified: 3/10/2026
StudioCMS has Authorization Bypass Through User-Controlled Key
Modified: 2/3/2026
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service
Modified: 3/13/2026
StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings
Modified: 3/14/2026
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation
Modified: 3/14/2026
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts
Modified: 3/14/2026
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
Modified: 3/18/2026