CVE-2026-30944

Katalog CVE

CVSS 8.8 · High EPSS 0,56%

Kerentanan Authorization Bypass Through User-Controlled Key pada studiocms. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID, resulting in a full privilege escalation. This vulnerability is fixed in 0.4.0.

Rincian

Terbit di NVD

10 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 44,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4 exploit · advisory vendor
• https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441 patch
• https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0 product