Description
The DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy.
Recommendation
Update the studiocms package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.3.0
- Patched version(s): 0.4.0
References
Could your website be exposed too?
SmartScanner can check your website for StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service and gives you actionable findings to investigate.
Start a free scanRelated Issues
- StudioCMS has Privilege Escalation via Insecure API Token Generation - CVE-2026-30944
- SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user - CVE-2026-34524
- tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809
- protobuf.js: Denial of service through unbounded protobuf recursion - CVE-2026-44289
You might also like:
See something that needs correcting? Let us knowUpdated March 11, 2026