Description
The REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank.
Recommendation
Update the studiocms package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.4.2
- Patched version(s): 0.4.3
References
Could your website be exposed too?
SmartScanner can check your website for StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts and gives you actionable findings to investigate.
Start a free scanRelated Issues
- StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check - CVE-2026-32101
- Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Ex - CVE-2026-45395
- StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens - CVE-2026-32638
- @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck - CVE-2026-39397
You might also like:
See something that needs correcting? Let us knowUpdated March 12, 2026