CVE-2026-32106
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts
CVSS Score
4.7
EPSS Score
0.0%
EPSS Percentile
0th
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts via the REST API, enabling privilege proliferation and persistence. This vulnerability is fixed in 0.4.3.
| CWE | CWE-269 |
| Vendor | withstudiocms |
| Product | studiocms |
| Published | Mar 11, 2026 |
| Last Updated | Mar 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for withstudiocms studiocms
Be the first to know when new medium vulnerabilities affecting withstudiocms studiocms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
withstudiocms / studiocms
< 0.4.3