CVE-2026-30945

Katalog CVE

CVSS 7.1 · High EPSS 0,46%

Kerentanan Authorization Bypass Through User-Controlled Key pada studiocms. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations. This vulnerability is fixed in 0.4.0.

Rincian

Terbit di NVD

10 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8rgj-vrfr-6hqr exploit · advisory vendor
• https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3 patch
• https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0 product