withstudiocms

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

withstudiocms records in CISA KEV

No withstudiocms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Studiocms 8 records HIGH

Records

8 records

TI-2026-23769 CVE-2026-30944 · GHSA-667w-mmh7-mrr4

StudioCMS Affected by Privilege Escalation via Insecure API Token Generation

HIGH 73

StudioCMS is a server-side-rendered, Astro native, headless content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00641 Published 2026-03-10 Fixed in 0.4.0 CWE-639

TI-2026-24639 CVE-2026-32101 · GHSA-mm78-fgq8-6pgr

StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check

HIGH 66

StudioCMS is a server-side-rendered, Astro native, headless content management system.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00213 Published 2026-03-11 Fixed in 0.3.1 CWE-863

TI-2026-24644 CVE-2026-32106 · GHSA-wj56-g96r-673q

StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

HIGH 65

StudioCMS is a server-side-rendered, Astro native, headless content management system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00338 Published 2026-03-11 Fixed in 0.4.3 CWE-269

TI-2026-24641 CVE-2026-32103 · GHSA-h7vr-cg25-jf8c

StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation

HIGH 65

StudioCMS is a server-side-rendered, Astro native, headless content management system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00387 Published 2026-03-11 Fixed in 0.4.3 CWE-639

TI-2026-19452 CVE-2026-24134 · GHSA-8cw6-53m5-4932

StudioCMS has an Authorization Bypass Through User-Controlled Key

MEDIUM 62

StudioCMS is a server-side-rendered, Astro native, headless content management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00343 Published 2026-01-27 Fixed in 0.2.0 CWE-639

TI-2026-24642 CVE-2026-32104 · GHSA-9v82-xrm4-mp52

StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings

MEDIUM 58

StudioCMS is a server-side-rendered, Astro native, headless content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00285 Published 2026-03-11 Fixed in 0.4.3 CWE-639

TI-2026-25147 CVE-2026-32638 · GHSA-xvf4-ch4q-2m24

StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens

MEDIUM 47

StudioCMS is a server-side-rendered, Astro native, headless content management system.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00398 Published 2026-03-18 Fixed in 0.4.4 CWE-639

TI-2026-23770 CVE-2026-30945 · GHSA-8rgj-vrfr-6hqr

StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

LOW 32

StudioCMS is a server-side-rendered, Astro native, headless content management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00525 Published 2026-03-10 Fixed in 0.4.0 CWE-639

Open these records in search →