CVE-2026-24134
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Jan 28, 2026
CISA due date
—
The record
StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/Owner users. Version 0.2.0 patches the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | studiocms | 0 | 0.2.0 |
Related vulnerabilities
- GHSA-8cw6-53m5-4932 StudioCMS has Authorization Bypass Through User-Controlled Key Same vulnerability
- CVE-2026-32638 StudioCMS is a server-side-rendered, Astro native, headless content management system. Also affects studiocms
- GHSA-xvf4-ch4q-2m24 StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens Also affects studiocms
- GHSA-wj56-g96r-673q StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts Also affects studiocms
- GHSA-9v82-xrm4-mp52 StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify… Also affects studiocms
- GHSA-h7vr-cg25-jf8c StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation Also affects studiocms
- CVE-2026-32106 StudioCMS is a server-side-rendered, Astro native, headless content management system. Also affects studiocms
- CVE-2026-32103 StudioCMS is a server-side-rendered, Astro native, headless content management system. Also affects studiocms