CVE-2026-30945: StudioCMS Arbitrary API Token Revocation Vulnerability
Summary
CVE-2026-30945: StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service. Affects studiocms versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
StudioCMS is an open-source content management system designed for managing digital content and automating workflows. It provides features for user management, API integrations, and content publishing. However, a critical vulnerability exists in the API token management functionality, allowing unauthorized token revocation, which can disrupt services and integrations.
Vulnerability Detail
The vulnerability arises from the DELETE /studiocms_api/dashboard/api-tokens endpoint, which permits any authenticated user with editor privileges or higher to revoke API tokens of any user, including those of admins and owners. The endpoint lacks proper checks for token ownership and caller identity, leading to potential denial of service for critical integrations. Attackers can exploit this flaw to revoke tokens indiscriminately, causing automated workflows to fail without warning. The vulnerability is classified under CWE-639, indicating insufficient authorization checks.
How To Fix
Latest published version: 0.7.0 as of 22 Oct 2026
npm install studiocms@0.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.0
This is the first release that contains the fix.
npm install studiocms@0.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the DELETE /studiocms_api/dashboard/api-tokens endpoint to only users with administrative privileges until the package can be updated.
Conclusion
The CVE-2026-30945 vulnerability in StudioCMS poses a significant risk by allowing unauthorized API token revocation. It is crucial for users to update to version 0.4.0 or later to mitigate this risk and ensure the integrity of their integrations and workflows.
See every vulnerability recorded for studiocms →
FAQ
CVE-2026-30945 is a vulnerability in StudioCMS that allows unauthorized users to revoke API tokens belonging to other users, potentially leading to service disruptions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The main consequence is denial of service for integrations that rely on API tokens, which can lead to failures in automated workflows and loss of functionality.
If immediate updating is not possible, consider restricting access to the affected endpoint to higher-privileged users as a temporary measure.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for studiocms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
