CVE-2026-24134 is a medium-severity (CVSS 6.5) CWE-639 vulnerability in studiocms. A fix is available for studiocms — see the affected versions and patch details below.
StudioCMS has an Authorization Bypass Through User-Controlled Key
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-24134.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
CVE-2026-24134 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,636 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
studiocmsnpmDescription
Summary
StudioCMS contains a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/Owner users.
Details
The Issue:
The endpoint /dashboard/content-management/edit?edit={UUID} validates user authentication but does NOT validate:
- User role (should require Editor/Admin/Owner)
- Content ownership (should verify the draft belongs to the user)
This allows users with "Visitor" role (lowest privilege) to access draft content created by Editor/Admin/Owner users by directly accessing the edit URL with the content UUID.
PoC
- User A: Editor role (example username:
dummy04) - User B: Visitor role (example username:
dummy01)
Reproduction Steps:
Step 1 - Create draft as Editor:
- Login as User A (Editor role)
- Navigate to:
http://localhost:4321/dashboard/content-management - Create new content (it will stay as draft)
- After saving, note the UUID in the URL:
http://localhost:4321/dashboard/content-management/edit?edit=bad87630-69a4-4cd6-bcb2-6965839dc148
Copy this UUID: bad87630-69a4-4cd6-bcb2-6965839dc148
Step 2 - Access draft as Visitor:
- Login as Visitor and get auth_session cookie
curl -X POST "http://127.0.0.1:4321/studiocms_api/auth/login" -F 'username=dummy01' -F 'password=dummy01pass$'
-
Proof of Visitor permission
<img width="1899" height="450" alt="02" src="https://github.com/user-attachments/assets/aabd47d3-163f-4a56-8296-08bd40c5ccdc" /> -
Access Editor's draft using the UUID
curl "http://127.0.0.1:4321/dashboard/content-management/edit?edit=bad87630-69a4-4cd6-bcb2-6965839dc148" -H "Cookie: auth_session=qvawh6zv23hc2spu6xx7pzgrnn4rpd3q" -v
Result: Returns full HTML page with draft content (200 OK)
Impact
Impact Scenarios:
-
Information Disclosure:
- Visitor users can read unpublished drafts containing sensitive information
- Drafts may contain confidential business information, unreleased announcements, or proprietary content
- Competitive intelligence could be gathered from draft content
-
Privacy Violation:
- Personal notes, work-in-progress content, or internal communications in drafts exposed
- Violation of content creator privacy expectations
-
Business Impact:
- Premature disclosure of marketing campaigns, product launches, or announcements
- Loss of competitive advantage if draft strategies are exposed
- Potential compliance issues if drafts contain regulated information
-
Complete RBAC Bypass:
- The entire role-based access control system for draft content is bypassed
- "Visitor" role becomes equivalent to "Editor" for read access to drafts
- Undermines the trust model of multi-user content management
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | studiocms | all versions | 0.2.0npm install studiocms@0.2.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for studiocms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update studiocms to 0.2.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-24134 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-24134 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-24134. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-24134 in your dependencies?
O3 Security finds CVE-2026-24134 across npm dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.