TI-2026-25147 CVE-2026-32638 · GHSA-xvf4-ch4q-2m24
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
Priority MEDIUM 47
StudioCMS is a server-side-rendered, Astro native, headless content management system.
Vulnerabilities
8 records
TI-2026-24642 CVE-2026-32104 · GHSA-9v82-xrm4-mp52
StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings
Priority MEDIUM 58
StudioCMS is a server-side-rendered, Astro native, headless content management system.
TI-2026-24644 CVE-2026-32106 · GHSA-wj56-g96r-673q
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts
Priority HIGH 65
StudioCMS is a server-side-rendered, Astro native, headless content management system.
TI-2026-24641 CVE-2026-32103 · GHSA-h7vr-cg25-jf8c
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation
Priority HIGH 65
StudioCMS is a server-side-rendered, Astro native, headless content management system.
TI-2026-24639 CVE-2026-32101 · GHSA-mm78-fgq8-6pgr
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
Priority HIGH 66
StudioCMS is a server-side-rendered, Astro native, headless content management system.
TI-2026-23770 CVE-2026-30945 · GHSA-8rgj-vrfr-6hqr
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service
Priority LOW 32
StudioCMS is a server-side-rendered, Astro native, headless content management system.
TI-2026-23769 CVE-2026-30944 · GHSA-667w-mmh7-mrr4
StudioCMS Affected by Privilege Escalation via Insecure API Token Generation
Priority HIGH 73
StudioCMS is a server-side-rendered, Astro native, headless content management system.
TI-2026-19452 CVE-2026-24134 · GHSA-8cw6-53m5-4932
StudioCMS has an Authorization Bypass Through User-Controlled Key
Priority MEDIUM 62
StudioCMS is a server-side-rendered, Astro native, headless content management system.