Skip to main content
cve.nowby Sazabi
← npm
npmPackage

studiocms

7 known vulnerabilities (2 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 high, 4 medium, 1 low
Weekly downloads
285
Dependents
0
Registry
npm

Advisories 7

  • StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens

    Affected: fixed in 0.4.4.

  • CVE-2026-32104Medium 5.4

    StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings

    Affected: fixed in 0.4.3.

  • CVE-2026-32106Medium 4.7

    StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

    Affected: fixed in 0.4.3.

  • CVE-2026-32103Medium 6.8

    StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation

    Affected: fixed in 0.4.3.

  • StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

    Affected: fixed in 0.4.0.

  • StudioCMS Affected by Privilege Escalation via Insecure API Token Generation

    Affected: fixed in 0.4.0.

  • CVE-2026-24134Medium 6.5

    StudioCMS has an Authorization Bypass Through User-Controlled Key

    Affected: fixed in 0.2.0.