CVE-2026-30944 - Vulnerability Analysis

Overview

StudioCMS < 0.4.0 contains a broken access control vulnerability caused by improper authorization validation in /studiocms_api/dashboard/api-tokens endpoint, letting authenticated users escalate privileges by generating API tokens for any user.

Severity & Score

Impact

Authenticated users can escalate privileges to owner or admin by generating API tokens for any user.

Mitigation

Update to version 0.4.0 or later.

References

• https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441
• https://github.com/withstudiocms/studiocms/releases/tag/[email protected]
• https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 10, 2026

🟠 CVE-2026-30944 - High (8.8) StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, incl... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30944/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

GitHub Repositories(1 repo)

• https://github.com/FilipeGaudard/CVE-2026-30944-PoC

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner