CVE-2026-30944

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30944", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T17:34:39.979Z", "datePublished": "2026-03-10T16:48:55.353Z", "dateUpdated": "2026-03-10T17:34:22.878Z"}, "containers": {"cna": {"title": "StudioCMS Affected by Privilege Escalation via Insecure API Token Generation", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4"}, {"name": "https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441", "tags": ["x_refsource_MISC"], "url": "https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441"}, {"name": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0"}], "affected": [{"vendor": "withstudiocms", "product": "studiocms", "versions": [{"version": "< 0.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T16:48:55.353Z"}, "descriptions": [{"lang": "en", "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID, resulting in a full privilege escalation. This vulnerability is fixed in 0.4.0."}], "source": {"advisory": "GHSA-667w-mmh7-mrr4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T17:33:50.492662Z", "id": "CVE-2026-30944", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:34:22.878Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30944", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T17:33:50.492662Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:33:54.256Z"}}], "cna": {"title": "StudioCMS Affected by Privilege Escalation via Insecure API Token Generation", "source": {"advisory": "GHSA-667w-mmh7-mrr4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "withstudiocms", "product": "studiocms", "versions": [{"status": "affected", "version": "< 0.4.0"}]}], "references": [{"url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4", "name": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441", "name": "https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0", "name": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID, resulting in a full privilege escalation. This vulnerability is fixed in 0.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T16:48:55.353Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30944", "state": "PUBLISHED", "dateUpdated": "2026-03-10T17:34:22.878Z", "dateReserved": "2026-03-07T17:34:39.979Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T16:48:55.353Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "studiocms", "vendor": "withstudiocms", "versions": [{"status": "affected", "version": "< 0.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:studiocms:studiocms:*:*:*:*:*:*:*:*", "matchCriteriaId": "087DD76D-B0EE-4D64-BDDD-9EDC994C5F1F", "versionEndExcluding": "0.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID, resulting in a full privilege escalation. This vulnerability is fixed in 0.4.0."}, {"lang": "es", "value": "StudioCMS es un sistema de gesti\u00f3n de contenido sin cabeza, nativo de Astro y renderizado en el lado del servidor. Antes de 0.4.0, el endpoint /studiocms_api/dashboard/api-tokens permite a cualquier usuario autenticado (al menos Editor) generar tokens de API para cualquier otro usuario, incluyendo cuentas de propietario y administrador. El endpoint no valida si el usuario solicitante est\u00e1 autorizado para crear tokens en nombre del ID de usuario objetivo, lo que resulta en una escalada de privilegios completa. Esta vulnerabilidad se corrige en 0.4.0."}], "id": "CVE-2026-30944", "lastModified": "2026-06-17T10:33:11.910", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30944", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T17:33:50.492662Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:54.260", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "studiocms", "source": "cna", "vendor": "withstudiocms"}, "product": "studiocms", "vendor": "withstudiocms"}], "analysis": {"en": {"generated_at": "2026-04-17T11:42:09.552620+00:00", "value": {"mitigation_remediation": ["Upgrade StudioCMS to version 0.4.0 or later to apply the vendor\u2019s patch that enforces proper authorization checks", "Restrict the /studiocms_api/dashboard/api-tokens endpoint so that only owner or administrator accounts can create or manage tokens, or disable token creation for non\u2011admin roles in the configuration", "Monitor API logs for anomalous token creation activity and enforce monitoring policies to detect privilege escalation attempts"], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "StudioCMS version releases prior to 0.4.0 are affected. The vulnerability is present in all releases shipped before the 0.4.0 update, which introduced proper access control for token generation. The product, developed by withstudiocms, is a server\u2011side\u2011rendered, Astro\u2011native, headless content management system deployed on web servers that expose a REST API.", "description_and_impact": "The vulnerability resides in the /studiocms_api/dashboard/api-tokens endpoint of StudioCMS, which does not validate that the user creating a token is authorized to do so for the target user ID. As a result, any authenticated user at least with Editor level can generate API tokens for other users, including owners and administrators, thereby gaining full administrative access. This flaw permits unprivileged attackers to impersonate admin users and potentially modify or delete content, access sensitive data, or gain further system compromise. The weakness aligns with CWE\u2011639 (Authorization Bypass Through User-Controlled Key) and CWE\u2011863 (Privilege Escalation via Improper Access Control).", "risk_and_exploitability": "The CVSS score of 8.8 indicates high severity. The calculated likelihood of exploitation is very low, and the vulnerability is not recorded in the known exploited vulnerabilities catalog. However, since any authenticated user can exploit the flaw, the attack vector is relatively simple and requires only possession of credentials that grant at least Editor role. Once exploited, the attacker can create tokens that authorize actions with elevated privileges. The lack of known active exploits implies a low exploitation probability, but the potential impact remains high if the flaw is discovered and used in a targeted campaign."}}}}, "created": "2026-03-11T11:49:07.697473+00:00", "updated": "2026-04-17T11:45:06.245602+00:00", "vendors": ["withstudiocms", "withstudiocms$PRODUCT$studiocms"]}