CVE-2026-32103: StudioCMS Admin-to-Owner Account Takeover via Password Reset Link Generation
Summary
CVE-2026-32103: StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation. Affects studiocms versions < 0.4.3. Fixed in 0.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
StudioCMS is a content management system designed for managing digital content and user interactions. It offers features such as user management, content creation, and administrative controls. However, a critical vulnerability has been identified that allows an admin user to generate password reset tokens for any user, including the owner, leading to potential account takeover.
Vulnerability Detail
The vulnerability exists in the POST /studiocms_api/dashboard/create-reset-link endpoint, where any authenticated user with admin privileges can generate a password reset token for any user without proper authorization checks. This oversight allows an admin to target the owner account, leading to a complete account takeover. The lack of caller identity validation and role hierarchy enforcement means that an admin can reset the owner's password and gain full control over the StudioCMS instance.
How To Fix
Latest published version: 0.7.0 as of 22 Oct 2026
npm install studiocms@0.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.3
This is the first release that contains the fix.
npm install studiocms@0.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, limit admin access to the password reset functionality until the package can be updated. Additionally, consider implementing role-based access controls to restrict admin actions on higher-privileged accounts.
Conclusion
The vulnerability CVE-2026-32103 in StudioCMS poses a significant risk by allowing admin users to reset the owner's password. It is crucial to update to the patched version to mitigate this risk and ensure the security of the application.
See every vulnerability recorded for studiocms →
FAQ
CVE-2026-32103 is a vulnerability in StudioCMS that allows an admin user to generate password reset tokens for any user, including the owner, leading to potential account takeover.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, an admin can change the owner's password, gaining full control over the StudioCMS instance, including access to all content and user management features.
Update the StudioCMS package to version 0.4.3 or later using the command: npm install studiocms@0.4.3.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for studiocms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
