StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens

Summary The REST API getUsers endpoint in StudioCMS uses the attacker-controlled rank query parameter to decide whether owner accounts should be filtered from the result set. As a result, an admin token can request rank=owner and receive owner account records, including IDs, usernames, display...

@studiocms/migrator (>=0.2.0 <=0.2.1) potentially affected by CVE-2026-32638 via studiocms (>=0.2.0 <=0.3.0)

studiocms NPM version =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2026-32638 Source advisory: SNYK:JS-STUDIOCMS-15682412...

@withstudiocms/api-spec (>=0.3.0 <=0.3.1), @withstudiocms/effect (=0.4.0) +1 more potentially affected by CVE-2026-32638 via effectify (=0.1.1)

effectify NPM version =0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on effectify and may be impacted: - @withstudiocms/api-spec =0.3.0, =0.4.0, =0.4.3 Source cves: CVE-2026-32638 Source advisory: SNYK:JS-EFFECTIFY-15682413...

Authorization Bypass Through User-Controlled Key

Overview studiocms is an A Community-Driven Astro native CMS. Built from the ground up by the Astro community. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the getUsers process. An attacker can access sensitive owner account information,...

GHSA-XVF4-CH4Q-2M24 StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens

Summary The REST API getUsers endpoint in StudioCMS uses the attacker-controlled rank query parameter to decide whether owner accounts should be filtered from the result set. As a result, an admin token can request rank=owner and receive owner account records, including IDs, usernames, display...

CVE-2026-32638

creationtimestamp| type| source ---|---|--- 2026-03-14 05:59:34+00:00| published-proof-of-concept| https://github.com/withstudiocms/studiocms/security/advisories/GHSA-xvf4-ch4q-2m24...

GHSA-WJ56-G96R-673Q StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

Summary The REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts...

EUVD-2026-11375

StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts...

GHSA-9V82-XRM4-MP52 StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings

Summary The updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account id !== userData.user.id. Any authenticated visitor...

EUVD-2026-11373

StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings...

@studiocms/migrator (>=0.2.0 <=0.2.1) potentially affected by CVE-2026-32103 via studiocms (>=0.2.0 <=0.3.0)

studiocms NPM version =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2026-32103 Source advisory: SNYK:JS-STUDIOCMS-15627222...

Authorization Bypass Through User-Controlled Key

Overview studiocms is an A Community-Driven Astro native CMS. Built from the ground up by the Astro community. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the create-reset-link process. An attacker can gain unauthorized access to...

@withstudiocms/api-spec (>=0.3.0 <=0.3.1), @withstudiocms/effect (=0.4.0) +1 more potentially affected by CVE-2026-32103 via effectify (=0.1.1)

effectify NPM version =0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on effectify and may be impacted: - @withstudiocms/api-spec =0.3.0, =0.4.0, =0.4.3 Source cves: CVE-2026-32103 Source advisory: SNYK:JS-EFFECTIFY-15627223...

@studiocms/migrator (>=0.1.0 <=0.2.1), @withstudiocms/auth-kit (>=0.1.0 <=0.1.3) +2 more potentially affected by CVE-2026-32103 via @withstudiocms/effect (>=0.1.0-beta.1 <=0.3.0)

@withstudiocms/effect NPM version =0.1.0-beta.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0 Source cves: CVE-2026-32103 Source advisory: SNYK:JS-WITHSTUDIOCMSEFFECT-15627226...

@studiocms/migrator (>=0.2.0 <=0.2.1) potentially affected by CVE-2026-32106 via studiocms (>=0.2.0 <=0.3.0)

studiocms NPM version =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2026-32106 Source advisory: SNYK:JS-STUDIOCMS-15666774...

Incorrect Privilege Assignment

Overview studiocms is an A Community-Driven Astro native CMS. Built from the ground up by the Astro community. Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the RestApiSecureHandler user creation flow in...

Authorization Bypass Through User-Controlled Key

Overview studiocms is an A Community-Driven Astro native CMS. Built from the ground up by the Astro community. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the updateUserNotifications handler in...

@studiocms/migrator (>=0.2.0 <=0.2.1) potentially affected by CVE-2026-32104 via studiocms (>=0.2.0 <=0.3.0)

studiocms NPM version =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2026-32104 Source advisory: SNYK:JS-STUDIOCMS-15665373...

CVE-2026-32101

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in...

CVE-2026-32104 StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferences. It checks that the caller is logged in but never...