studiocms
npm7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting studiocmspage 1 of 1
- CVE-2026-24134MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.2.02026-01-28
StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "V…
- CVE-2026-30944HIGHCVSS 8.8EG 8.8✓ Fixed in 0.4.02026-03-10
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other us…
- CVE-2026-30945HIGHCVSS 7.1EG 7.1✓ Fixed in 0.4.02026-03-10
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API toke…
- CVE-2026-32103HIGHCVSS 7.2EG 7.2✓ Fixed in 0.4.32026-03-11
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password …
- CVE-2026-32104MEDIUMCVSS 5.4EG 5.4✓ Fixed in 0.4.32026-03-11
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferenc…
- CVE-2026-32106HIGHCVSS 7.2EG 7.2✓ Fixed in 0.4.32026-03-11
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses ind…
- CVE-2026-32638LOWCVSS 2.7EG 2.7✓ Fixed in 0.4.42026-03-18
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the attacker-controlled `rank` query parameter to decide whether owner accounts shoul…
Check whether studiocms is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for studiocms CVEs against the assets you own.
Start Free Scan →