CVE-2026-32106: StudioCMS REST API Allows Unauthorized Creation of Peer Admin Accounts
Summary
CVE-2026-32106: StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts. Affects studiocms versions < 0.4.3. Fixed in 0.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
StudioCMS is a content management system designed for creating and managing digital content. It provides a REST API for developers to interact with its functionalities programmatically. The system allows user management, including the creation of user accounts with different permission levels. However, a vulnerability in the REST API's user creation endpoint has been identified, which permits administrators to create additional admin accounts without proper authorization checks.
Vulnerability Detail
The vulnerability arises from inconsistent rank checks in the REST API's createUser endpoint. While the Dashboard API correctly prevents an admin from creating users with equal or higher ranks, the REST API only blocks the creation of 'owner' accounts. This inconsistency allows an admin to create additional admin accounts, leading to privilege escalation and potential unauthorized access to sensitive functionalities. A compromised admin could exploit this vulnerability to establish persistence mechanisms that survive password resets or token revocations.
How To Fix
Latest published version: 0.7.0 as of 22 Oct 2026
npm install studiocms@0.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.3
This is the first release that contains the fix.
npm install studiocms@0.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the REST API for admin users until the patch is applied. This can be done by implementing additional access controls or using middleware to validate user permissions before allowing access to the createUser endpoint.
Conclusion
The CVE-2026-32106 vulnerability in StudioCMS poses a significant risk by allowing unauthorized creation of admin accounts through the REST API. It is crucial to update to version 0.4.3 or later to mitigate this risk and ensure proper authorization checks are in place. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for studiocms →
FAQ
CVE-2026-32106 is a vulnerability in the StudioCMS REST API that allows administrators to create additional admin accounts without proper authorization checks.
An attacker with admin access can exploit this vulnerability to create peer admin accounts, leading to unauthorized access and privilege escalation.
The vulnerability can lead to unauthorized access to sensitive functionalities, persistence mechanisms for compromised accounts, and confusion regarding authorization boundaries.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If immediate updates are not possible, consider implementing access controls to restrict admin access to the REST API as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for studiocms.
