CVE-2026-30945CWE-639CWE-863

StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

High · published March 10, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations. This vulnerability is fixed in 0.4.0.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00463 · 39.2th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-863 · Incorrect Authorization
Published
2026-03-10T16:52Z
EPSS history
Timeline
  • 10 MAR 16:52Z
    StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service
    cvelistv5