CVE-2026-30945: StudioCMS Auth Bypass Vulnerability

CVE-2026-30945 Overview

CVE-2026-30945 is an Insecure Direct Object Reference (IDOR) vulnerability affecting StudioCMS, a server-side-rendered, Astro native, headless content management system. Prior to version 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy, enabling targeted denial of service against critical integrations and automations.

Critical Impact

Authenticated attackers with minimal privileges can revoke API tokens for admin and owner accounts, disrupting critical integrations and automations across the entire StudioCMS deployment.

Affected Products

• StudioCMS versions prior to 0.4.0

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-30945 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30945

Vulnerability Analysis

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). The core issue lies in the API endpoint's failure to implement proper authorization checks before performing destructive operations on user resources.

When processing DELETE requests to the /studiocms_api/dashboard/api-tokens endpoint, the application accepts tokenID and userID parameters directly from the request payload. The vulnerable handler trusts these client-supplied values without performing essential security validations, including: verifying that the requesting user owns the target token, confirming the caller's identity matches the userID parameter, and enforcing role hierarchy restrictions to prevent lower-privileged users from affecting higher-privileged accounts.

This authorization bypass enables any authenticated user with editor-level access to enumerate and revoke API tokens belonging to administrators, owners, or other privileged users. The attack requires no special technical knowledge beyond basic API interaction and can be executed with minimal effort once authentication is achieved.

Root Cause

The root cause is the absence of authorization logic in the token deletion handler. The endpoint processes the request based solely on the client-provided tokenID and userID without cross-referencing against the authenticated session's user identity or privilege level. This represents a fundamental broken access control pattern where user-supplied object references are trusted without server-side ownership validation.

Attack Vector

The attack is network-based and requires low privileges (editor-level access) with no user interaction. An authenticated attacker can craft malicious DELETE requests to the vulnerable endpoint, specifying arbitrary tokenID and userID combinations. By systematically revoking API tokens, an attacker can:

1. Disrupt automated workflows and CI/CD pipelines that depend on API tokens
2. Force re-authentication for administrative accounts
3. Cause denial of service for critical integrations
4. Potentially lock out legitimate administrators from API-based operations

The vulnerability mechanism involves the following attack flow: An attacker authenticates with editor credentials, identifies or enumerates valid token IDs (potentially through other API endpoints or predictable patterns), then sends DELETE requests with target user IDs to revoke their tokens. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-30945

Indicators of Compromise

• Unusual patterns of API token deletion requests from non-admin accounts
• Multiple DELETE requests to /studiocms_api/dashboard/api-tokens targeting different user IDs from a single session
• Unexpected token revocation events in audit logs for admin or owner accounts
• Integration failures or authentication errors in automated systems that were previously working

Detection Strategies

• Monitor API access logs for DELETE requests to the /studiocms_api/dashboard/api-tokens endpoint where the authenticated user differs from the target userID
• Implement alerting for bulk token deletion operations or rapid successive token revocations
• Audit authentication logs for patterns indicating token enumeration attempts
• Deploy web application firewall (WAF) rules to detect and block suspicious IDOR attack patterns

Monitoring Recommendations

• Enable detailed logging for all token management API endpoints including caller identity and target resources
• Configure alerts for token deletion events affecting admin or owner-level accounts
• Implement rate limiting on token management endpoints to slow potential enumeration attacks
• Review integration health dashboards for unexpected authentication failures

How to Mitigate CVE-2026-30945

Immediate Actions Required

• Upgrade StudioCMS to version 0.4.0 or later immediately
• Audit recent API token deletion logs for unauthorized revocations
• Regenerate API tokens for critical integrations and administrative accounts
• Temporarily restrict editor-level access if upgrade cannot be performed immediately

Patch Information

The vulnerability has been fixed in StudioCMS version 0.4.0. The security patch is available via the GitHub Release. The fix implements proper authorization checks to ensure users can only manage their own API tokens, and enforces role hierarchy to prevent privilege boundary violations.

The specific code changes can be reviewed in the security commit 9eec9c3b45523b635cfe16d55aa55afabacbebe3.

Workarounds

• If upgrading is not immediately possible, implement network-level access controls to restrict access to the vulnerable endpoint
• Deploy a reverse proxy or WAF rule to validate that authenticated user IDs match the userID parameter in DELETE requests
• Temporarily disable the API token management functionality until the patch can be applied
• Restrict editor-level account provisioning and audit existing editor accounts for potential compromise

# Example: Restrict access to vulnerable endpoint via nginx
location /studiocms_api/dashboard/api-tokens {
    # Temporarily block DELETE requests until patched
    if ($request_method = DELETE) {
        return 403;
    }
    proxy_pass http://studiocms_backend;
}