Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-32106StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

Medium 4.7

In plain English

A medium-severity privilege mismanagement in studiocms from withstudiocms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.3%top 72.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts via the REST API, enabling privilege proliferation and persistence. This vulnerability is fixed in 0.4.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	studiocms	0.4.3	GHSA-wj56-g96r-673q

Affected products (as reported)

Vendor	Product	Versions
withstudiocms	studiocms	< 0.4.3

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/withstudiocms/studiocms/security/advisories/GHSA-wj56-g96r-673q x_refsource_CONFIRM