Description
The DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy.
Recommendation
Update the studiocms package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.3.0
- Patched version(s): 0.4.0
References
Could your website be exposed too?
SmartScanner can check your website for StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service and gives you actionable findings to investigate.
Start a free scanRelated Issues
- StudioCMS has Privilege Escalation via Insecure API Token Generation - CVE-2026-30944
- @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service - CVE-2026-40074
- Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer - CVE-2026-41680
- Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig - CVE-2026-25639
You might also like:
See something that needs correcting? Let us knowUpdated March 11, 2026