CVE-2026-30944: StudioCMS Privilege Escalation via Insecure API Token Generation
Summary
CVE-2026-30944: StudioCMS has Privilege Escalation via Insecure API Token Generation. Affects studiocms versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
StudioCMS is a content management system designed for managing digital content and facilitating website development. It provides features such as user management, API access, and content editing capabilities. However, a critical vulnerability exists in its API token generation mechanism, allowing unauthorized users to escalate privileges and access sensitive functionalities.
Vulnerability Detail
The vulnerability arises from the /studiocms_api/dashboard/api-tokens endpoint, which permits any authenticated user with at least Editor privileges to generate API tokens for any user, including those with owner and admin roles. The server fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID, leading to a classic Broken Object Level Authorization (BOLA) issue. This flaw allows attackers to impersonate any user in the system, potentially leading to account takeover, data breaches, and unauthorized access to sensitive information.
How To Fix
Latest published version: 0.7.0 as of 22 Oct 2026
npm install studiocms@0.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.0
This is the first release that contains the fix.
npm install studiocms@0.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the /studiocms_api/dashboard/api-tokens endpoint to only trusted users or roles until the package is updated. Additionally, consider implementing additional authorization checks in the server-side logic to validate user permissions more effectively.
Conclusion
The privilege escalation vulnerability in StudioCMS (CVE-2026-30944) poses significant risks to user accounts and sensitive data. It is crucial for users to update to the patched version 0.4.0 or later to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for studiocms →
FAQ
CVE-2026-30944 is a vulnerability in StudioCMS that allows authenticated users to generate API tokens for any user, leading to privilege escalation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to privilege escalation, account takeover, and unauthorized access to sensitive data and functionalities within the application.
Yes, a patch is available in version 0.4.0 of the StudioCMS package, which addresses the vulnerability.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for studiocms.
