CVE-2026-32106

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32106", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T22:02:38.854Z", "datePublished": "2026-03-11T20:09:12.095Z", "dateUpdated": "2026-03-12T19:48:33.042Z"}, "containers": {"cna": {"title": "StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-wj56-g96r-673q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-wj56-g96r-673q"}], "affected": [{"vendor": "withstudiocms", "product": "studiocms", "versions": [{"version": "< 0.4.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T20:09:12.095Z"}, "descriptions": [{"lang": "en", "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts via the REST API, enabling privilege proliferation and persistence. This vulnerability is fixed in 0.4.3."}], "source": {"advisory": "GHSA-wj56-g96r-673q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T19:48:27.305162Z", "id": "CVE-2026-32106", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:48:33.042Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32106", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T19:48:27.305162Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T19:48:30.362Z"}}], "cna": {"title": "StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts", "source": {"advisory": "GHSA-wj56-g96r-673q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "withstudiocms", "product": "studiocms", "versions": [{"status": "affected", "version": "< 0.4.3"}]}], "references": [{"url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-wj56-g96r-673q", "name": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-wj56-g96r-673q", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts via the REST API, enabling privilege proliferation and persistence. This vulnerability is fixed in 0.4.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T20:09:12.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32106", "state": "PUBLISHED", "dateUpdated": "2026-03-12T19:48:33.042Z", "dateReserved": "2026-03-10T22:02:38.854Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T20:09:12.095Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "studiocms", "vendor": "withstudiocms", "versions": [{"status": "affected", "version": "< 0.4.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:studiocms:studiocms:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD3D1012-B2EE-465F-8398-96C5B01C1399", "versionEndExcluding": "0.4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts via the REST API, enabling privilege proliferation and persistence. This vulnerability is fixed in 0.4.3."}, {"lang": "es", "value": "StudioCMS es un sistema de gesti\u00f3n de contenido sin cabeza, nativo de Astro y renderizado en el lado del servidor. Antes de la versi\u00f3n 0.4.3, el endpoint createUser de la API REST utiliza comprobaciones de rango basadas en cadenas que solo bloquean la creaci\u00f3n de cuentas de propietario, mientras que la API del Panel de Control utiliza una comparaci\u00f3n de rango basada en indexOf que impide la creaci\u00f3n de usuarios con un rango igual o superior al propio. Esta inconsistencia permite a un administrador crear cuentas de administrador adicionales a trav\u00e9s de la API REST, lo que permite la proliferaci\u00f3n y persistencia de privilegios. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.4.3."}], "id": "CVE-2026-32106", "lastModified": "2026-06-17T10:35:08.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32106", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T19:48:27.305162Z", "version": "2.0.3"}}]}, "published": "2026-03-11T21:16:16.603", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-wj56-g96r-673q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.4.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "studiocms", "source": "cna", "vendor": "withstudiocms"}, "product": "studiocms", "vendor": "withstudiocms"}], "analysis": {"en": {"generated_at": "2026-03-17T17:32:49.048281+00:00", "value": {"mitigation_remediation": ["Update StudioCMS to version 0.4.3 or later."], "summary": {"action": "Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "All installations of StudioCMS with a version older than 0.4.3 are affected. The affected product is identified by the CPE string cpe:2.3:a:studiocms:studiocms:*:*:*:*:*:*:*:* and is distributed by the vendor withstudiocms.", "description_and_impact": "StudioCMS, a server\u2011side\u2011rendered, Astro\u2011native headless CMS, contains a flaw in the REST API createUser endpoint where a string\u2011based rank check only blocks the creation of owner accounts. The Dashboard API, by contrast, uses an indexOf\u2011based comparison that correctly prevents users from creating accounts at or above their own rank. This inconsistency allows an authenticated admin to create additional admin accounts through the REST API, thereby increasing the number and persistence of privileged accounts. The vulnerability is classified as CWE\u2011269 (Elevation of Privilege). The impact is confined to privilege escalation and does not explicitly state that additional functions such as content exfiltration are possible.", "risk_and_exploitability": "The CVSS base score is 4.7, indicating moderate severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an existing admin account with access to the REST API; the attacker must send a createUser request containing an admin rank. The likely attack vector, based on the description, is a network\u2011based API request from an environment that already has administrative privileges or has compromised an admin user. This attack enables privilege proliferation but does not grant any further exploits beyond elevating administrative privileges."}}}}, "created": "2026-03-12T09:56:15.136313+00:00", "updated": "2026-03-20T15:37:20.820748+00:00", "vendors": ["withstudiocms", "withstudiocms$PRODUCT$studiocms"]}