CVE-2026-24134 is a medium-severity (CVSS 6.5) CWE-639 vulnerability in studiocms. A fix is available for studiocms — see the affected versions and patch details below.
StudioCMS has an Authorization Bypass Through User-Controlled Key
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-24134.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
studiocmsnpmDescription
Summary
StudioCMS contains a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/Owner users.
Details
The Issue:
The endpoint /dashboard/content-management/edit?edit={UUID} validates user authentication but does NOT validate:
- User role (should require Editor/Admin/Owner)
- Content ownership (should verify the draft belongs to the user)
This allows users with "Visitor" role (lowest privilege) to access draft content created by Editor/Admin/Owner users by directly accessing the edit URL with the content UUID.
PoC
- User A: Editor role (example username:
dummy04) - User B: Visitor role (example username:
dummy01)
Reproduction Steps:
Step 1 - Create draft as Editor:
- Login as User A (Editor role)
- Navigate to:
http://localhost:4321/dashboard/content-management - Create new content (it will stay as draft)
- After saving, note the UUID in the URL:
http://localhost:4321/dashboard/content-management/edit?edit=bad87630-69a4-4cd6-bcb2-6965839dc148
Copy this UUID: bad87630-69a4-4cd6-bcb2-6965839dc148
Step 2 - Access draft as Visitor:
- Login as Visitor and get auth_session cookie
curl -X POST "http://127.0.0.1:4321/studiocms_api/auth/login" -F 'username=dummy01' -F 'password=dummy01pass$'
-
Proof of Visitor permission
<img width="1899" height="450" alt="02" src="https://github.com/user-attachments/assets/aabd47d3-163f-4a56-8296-08bd40c5ccdc" /> -
Access Editor's draft using the UUID
curl "http://127.0.0.1:4321/dashboard/content-management/edit?edit=bad87630-69a4-4cd6-bcb2-6965839dc148" -H "Cookie: auth_session=qvawh6zv23hc2spu6xx7pzgrnn4rpd3q" -v
Result: Returns full HTML page with draft content (200 OK)
Impact
Impact Scenarios:
-
Information Disclosure:
- Visitor users can read unpublished drafts containing sensitive information
- Drafts may contain confidential business information, unreleased announcements, or proprietary content
- Competitive intelligence could be gathered from draft content
-
Privacy Violation:
- Personal notes, work-in-progress content, or internal communications in drafts exposed
- Violation of content creator privacy expectations
-
Business Impact:
- Premature disclosure of marketing campaigns, product launches, or announcements
- Loss of competitive advantage if draft strategies are exposed
- Potential compliance issues if drafts contain regulated information
-
Complete RBAC Bypass:
- The entire role-based access control system for draft content is bypassed
- "Visitor" role becomes equivalent to "Editor" for read access to drafts
- Undermines the trust model of multi-user content management
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | studiocms | all versions | 0.2.0npm install studiocms@0.2.0 |
Affected Products
studiocmsstudiocmsDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for studiocms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update studiocms to 0.2.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-24134 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is CVE-2026-24134 in your dependencies?
Find it across npm, including transitive dependencies.