StudioCMS has Authorization Bypass Through User-Controlled Key
Date: 2026-01
Affected: npm/studiocms
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-24134
CWE: CWE-639
CWE-862
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

### Summary StudioCMS contains a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/Owner users. ### Details **The Issue:** The endpoint `/dashboard/content-management/edit?edit={UUID}` validates user authentication but does NOT validate: 1. User role (should require Editor/Admin/Owner) 2. Content ownership (should verify the draft belongs to the user) This allows users with "Visitor" role (lowest privilege) to access draft content created by Editor/Admin/Owner users by directly accessing the edit URL with the content UUID. ### PoC - **User A:** Editor role (example username: `dummy04`) - **User B:** Visitor role (example username: `dummy01`) **Reproduction Steps:** **Step 1 - Create draft as Editor:** 1. Login as User A (Editor role) 2. Navigate to: `http://localhost:4321/dashboard/content-management` 3. Create new content (it will stay as draft) 4. After saving, note the UUID in the URL: ```` http://localhost:4321/dashboard/content-management/edit?edit=bad87630-69a4-4cd6-bcb2-6965839dc148 ```` Copy this UUID: `bad87630-69a4-4cd6-bcb2-6965839dc148` **Step 2 - Access draft as Visitor:** 1. Login as Visitor and get auth_session cookie ``` curl -X POST "http://127.0.0.1:4321/studiocms_api/auth/login" -F 'username=dummy01' -F 'password=dummy01pass$' ``` <img width="1128" height="376" alt="01" src="https://github.com/user-attachments/


Mitigations:

Architectural layers (MAESTRO):