Studiocms

8 CVEs across 2 Studiocms products. Browse Studiocms vulnerabilities, severities, and proof-of-concept exploits.

Studiocms products with known CVEs

ProductCVEs
Studiocms8
S3-Storage1
Studiocms CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-32638Low2.72026-03-18StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the a…
CVE-2026-32106Medium4.72026-03-11StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank…
CVE-2026-32104Medium5.42026-03-11StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID f…
CVE-2026-32103Medium6.82026-03-11StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endp…
CVE-2026-32101High7.62026-03-11StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is decl…
CVE-2026-30945High7.12026-03-10StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint…
CVE-2026-30944High8.82026-03-10StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows…
CVE-2026-24134Medium6.52026-01-28StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOL…