Description
The updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user’s notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id).
Recommendation
Update the studiocms package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.4.2
- Patched version(s): 0.4.3
References
Could your website be exposed too?
SmartScanner can check your website for StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion - CVE-2026-23522
- payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) - CVE-2026-25574
- OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE - CVE-2026-30887
- StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts - CVE-2026-32106
You might also like:
See something that needs correcting? Let us knowUpdated March 12, 2026