Description
The updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user’s notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id).
Recommendation
Update the studiocms package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.4.2
- Patched version(s): 0.4.3
References
Could your website be exposed too?
SmartScanner can check your website for StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion - CVE-2026-23522
- StudioCMS has Authorization Bypass Through User-Controlled Key - CVE-2026-24134
- MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery - CVE-2026-63642
- StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts - CVE-2026-32106
You might also like:
See something that needs correcting? Let us knowUpdated March 12, 2026