CVE-2026-30945

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30945", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T17:34:39.979Z", "datePublished": "2026-03-10T16:52:14.650Z", "dateUpdated": "2026-03-10T19:16:41.910Z"}, "containers": {"cna": {"title": "StudioCMS: IDOR \u2014 Arbitrary API Token Revocation Leading to Denial of Service", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8rgj-vrfr-6hqr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8rgj-vrfr-6hqr"}, {"name": "https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3", "tags": ["x_refsource_MISC"], "url": "https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3"}, {"name": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0"}], "affected": [{"vendor": "withstudiocms", "product": "studiocms", "versions": [{"version": "< 0.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T16:52:14.650Z"}, "descriptions": [{"lang": "en", "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations. This vulnerability is fixed in 0.4.0."}], "source": {"advisory": "GHSA-8rgj-vrfr-6hqr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T19:16:24.577655Z", "id": "CVE-2026-30945", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T19:16:41.910Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30945", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T19:16:24.577655Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T19:16:33.405Z"}}], "cna": {"title": "StudioCMS: IDOR \u2014 Arbitrary API Token Revocation Leading to Denial of Service", "source": {"advisory": "GHSA-8rgj-vrfr-6hqr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "withstudiocms", "product": "studiocms", "versions": [{"status": "affected", "version": "< 0.4.0"}]}], "references": [{"url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8rgj-vrfr-6hqr", "name": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8rgj-vrfr-6hqr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3", "name": "https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0", "name": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations. This vulnerability is fixed in 0.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T16:52:14.650Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30945", "state": "PUBLISHED", "dateUpdated": "2026-03-10T19:16:41.910Z", "dateReserved": "2026-03-07T17:34:39.979Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T16:52:14.650Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "studiocms", "vendor": "withstudiocms", "versions": [{"status": "affected", "version": "< 0.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:studiocms:studiocms:*:*:*:*:*:*:*:*", "matchCriteriaId": "087DD76D-B0EE-4D64-BDDD-9EDC994C5F1F", "versionEndExcluding": "0.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations. This vulnerability is fixed in 0.4.0."}, {"lang": "es", "value": "StudioCMS es un sistema de gesti\u00f3n de contenido renderizado en el lado del servidor, nativo de Astro y sin cabeza. Antes de la versi\u00f3n 0.4.0, el endpoint DELETE /studiocms_api/dashboard/api-tokens permite a cualquier usuario autenticado con privilegios de editor o superiores revocar tokens de API pertenecientes a cualquier otro usuario, incluyendo cuentas de administrador y propietario. El gestor acepta tokenID y userID directamente del payload de la solicitud sin verificar la propiedad del token, la identidad del llamador o la jerarqu\u00eda de roles. Esto permite una denegaci\u00f3n de servicio dirigida contra integraciones y automatizaciones cr\u00edticas. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.4.0."}], "id": "CVE-2026-30945", "lastModified": "2026-06-17T10:33:12.017", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30945", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T19:16:24.577655Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:54.433", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8rgj-vrfr-6hqr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "studiocms", "source": "cna", "vendor": "withstudiocms"}, "product": "studiocms", "vendor": "withstudiocms"}], "analysis": {"en": {"generated_at": "2026-04-16T03:48:27.241235+00:00", "value": {"mitigation_remediation": ["Upgrade StudioCMS to version 0.4.0 or later, which removes the vulnerable endpoint and implements proper ownership checks", "If an upgrade is not immediately, modify your application to enforce that only the token owner, administrators, or privileged services can request token revocation, rejecting requests for other users' tokens", "Implement monitoring of token revocation logs to detect suspicious activity and, if feasible, temporarily disable the DELETE /studiocms_api/dashboard/api-tokens endpoint on older installations until a patch can be applied"], "summary": {"action": "Immediate Patch", "impact": "Denial of Service to integrations via unauthorized token revocation"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in StudioCMS releases before 0.4.0. The affected product is StudioCMS, as identified by the vendor withstudiocms and the product studiocms. All installations that have not applied the 0.4.0 patch or later are susceptible, regardless of the host environment.", "description_and_impact": "StudioCMS allows any authenticated user with editor privileges or higher to delete API tokens of any account by sending a DELETE request to /studiocms_api/dashboard/api-tokens. The request payload accepts a tokenID and userID without validating that the token belongs to the caller or that the caller has authority over that account. This unauthorized removal of tokens can prevent automated tools, third\u2011party services, or scheduled jobs from authenticating, effectively causing a denial of service to those integrations. The weakness is an IDOR, classified as CWE\u2011639 and CWE\u2011863.", "risk_and_exploitability": "The CVSS score of 7.1 reflects moderate to high severity. The EPSS score is below 1%, indicating very low probability that this vulnerability is exploited in the wild. The vulnerability is not currently listed in the CISA KEV catalog. An attacker needs to be authenticated with at least editor role, so the attack is not purely remote and requires legitimate credentials. Still, the ease of revoking tokens and the potential disruption to business-critical integrations make it a significant risk if not mitigated."}}}}, "created": "2026-03-11T11:49:06.170613+00:00", "updated": "2026-04-16T04:00:09.436267+00:00", "vendors": ["withstudiocms", "withstudiocms$PRODUCT$studiocms"]}