Wwithstudiocms

Products

Exploited and recent CVEs

• CVE-2026-32638 Low 2.7 StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens 0.4%
• CVE-2026-32104 Medium 5.4 StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings 0.3%
• CVE-2026-32106 Medium 4.7 StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts 0.3%
• CVE-2026-32103 Medium 6.8 StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation 0.4%
• CVE-2026-30945 High 7.1 StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service 0.5%
• CVE-2026-30944 High 8.8 StudioCMS Affected by Privilege Escalation via Insecure API Token Generation 0.6%
• CVE-2026-24134 Medium 6.5 StudioCMS has an Authorization Bypass Through User-Controlled Key 0.3%