CVE-2026-32638— StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
Quick assessment
Affected
withstudiocms studiocms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
StudioCMS是StudioCMS开源的一个内容管理系统。 StudioCMS 0.4.4之前版本存在安全漏洞，该漏洞源于REST API getUsers端点使用攻击者控制的rank查询参数，可能导致管理员令牌获取所有者账户记录，造成授权不一致。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-32638
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
Source: CVE Program / CVE List V5
Vulnerability Description
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the attacker-controlled `rank` query parameter to decide whether owner accounts should be filtered from the result set. As a result, an admin token can request `rank=owner` and receive owner account records, including IDs, usernames, display names, and email addresses, even though the adjacent `getUser` endpoint correctly blocks admins from viewing owner users. This is an authorization inconsistency inside the same user-management surface. Version 0.4.4 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
StudioCMS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
StudioCMS是StudioCMS开源的一个内容管理系统。 StudioCMS 0.4.4之前版本存在安全漏洞，该漏洞源于REST API getUsers端点使用攻击者控制的rank查询参数，可能导致管理员令牌获取所有者账户记录，造成授权不一致。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| withstudiocms | studiocms | < 0.4.4 | - |
|
II. Public POCs for CVE-2026-32638
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-32638
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-32638 (1)
Vendor Advisories for CVE-2026-32638 (1)
Other References for CVE-2026-32638 (1)
-
Release studiocms@0.4.4 · withstudiocms/studiocms · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: studiocms
-
CVE-2026-32104
StudioCMS: IDOR in User Notification Preferences Allows Any -
CVE-2026-32106
StudioCMS: REST API Missing Rank Check Allows Admin to Creat -
CVE-2026-32103
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Passwo -
CVE-2026-30945
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to -
CVE-2026-30944
StudioCMS Affected by Privilege Escalation via Insecure API
Same vendor: withstudiocms
-
CVE-2026-32104
StudioCMS: IDOR in User Notification Preferences Allows Any -
CVE-2026-32106
StudioCMS: REST API Missing Rank Check Allows Admin to Creat -
CVE-2026-32103
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Passwo -
CVE-2026-30945
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to -
CVE-2026-30944
StudioCMS Affected by Privilege Escalation via Insecure API
Same weakness: CWE-639
-
CVE-2026-87975
Privilege abuse in model formsets with editable primary keys -
CVE-2026-105836
QloApps through 1.7.0 Authorization Bypass via ajaxProcessBu -
CVE-2026-39756
WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Obj -
CVE-2026-32576
WordPress Faktur Pro for WooCommerce plugin <= 3.2.1 - Insec -
CVE-2026-105572
PickMall Lilishop Buyer Invoice List receipt authorization
V. Comments for CVE-2026-32638
No comments yet