StudioCMS has Authorization Bypass Through User-Controlled Key

Description

StudioCMS contains a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the “Visitor” role to access draft content created by Editor/Admin/Owner users.

Recommendation

Update the studiocms package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.0
• Patched version(s): 0.2.0

References

• GHSA-8cw6-53m5-4932
• CVE-2026-24134
• CWE-639
• CWE-862
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• seroval affected by Denial of Service via RegExp serialization - CVE-2026-23956
• Happy DOM: VM Context Escape can lead to Remote Code Execution - CVE-2025-61927
• Improper Verification of Cryptographic Signature in node-forge - CVE-2022-24772
• Remote Code Execution on click of <a> Link in markdown preview - CVE-2024-49362

Tags:

npm

studiocms