CVE-2026-32638

The record

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the attacker-controlled `rank` query parameter to decide whether owner accounts should be filtered from the result set. As a result, an admin token can request `rank=owner` and receive owner account records, including IDs, usernames, display names, and email addresses, even though the adjacent `getUser` endpoint correctly blocks admins from viewing owner users. This is an authorization inconsistency inside the same user-management surface. Version 0.4.4 fixes the issue.

Affected packages

Related vulnerabilities

• GHSA-xvf4-ch4q-2m24 StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens Same vulnerability
• GHSA-wj56-g96r-673q StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts Also affects studiocms
• GHSA-9v82-xrm4-mp52 StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify… Also affects studiocms
• GHSA-h7vr-cg25-jf8c StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation Also affects studiocms
• CVE-2026-32106 StudioCMS is a server-side-rendered, Astro native, headless content management system. Also affects studiocms
• CVE-2026-32103 StudioCMS is a server-side-rendered, Astro native, headless content management system. Also affects studiocms
• CVE-2026-32104 StudioCMS is a server-side-rendered, Astro native, headless content management system. Also affects studiocms
• GHSA-8rgj-vrfr-6hqr StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service Also affects studiocms