Description
The /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID, resulting in a full privilege escalation.
Recommendation
Update the studiocms package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.3.0
- Patched version(s): 0.4.0
References
Could your website be exposed too?
SmartScanner can check your website for StudioCMS has Privilege Escalation via Insecure API Token Generation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation - CVE-2026-32103
- Orval has a code injection via unsanitized x-enum-descriptions in enum generation - CVE-2026-23947
- Cube Core is vulnerable to privilege escalation via a specially crafted request - CVE-2026-25958
- StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service - CVE-2026-30945
You might also like:
See something that needs correcting? Let us knowUpdated March 10, 2026