Is CVE-2026-24134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24134 being exploited in the wild.

How severe is CVE-2026-24134?

Low severity, with a CVSS score of 3.1, published 27 January 2026.

Which products and versions are affected?

studiocms (npm) SEMVER:introduced=0,fixed=0.2.0.

Is there a fix for CVE-2026-24134?

Yes. studiocms (npm): upgrade to 0.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24134 attacked?

It is attacked over the network.

Am I affected by CVE-2026-24134?

Check whether you run studiocms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24134: StudioCMS authorization bypass in content management

CVE-2026-24134 · Severity: low · CVSS 3.1 · Published 2026-01-27

StudioCMS is a content management system used to create and publish website content with role-based access controls. The vulnerability allows low-privilege "Visitor" users to view unpublished draft content created by editors and administrators by bypassing authorization checks. An attacker could expose confidential business information, unreleased announcements, or sensitive internal communications contained in draft posts.

Technologies: studiocms (npm). Vendors: npm.

Quick answers

Is CVE-2026-24134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24134 being exploited in the wild.
How severe is CVE-2026-24134?: Low severity, with a CVSS score of 3.1, published 27 January 2026.
Which products and versions are affected?: studiocms (npm) SEMVER:introduced=0,fixed=0.2.0.
Is there a fix for CVE-2026-24134?: Yes. studiocms (npm): upgrade to 0.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24134 attacked?: It is attacked over the network.
Am I affected by CVE-2026-24134?: Check whether you run studiocms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

studiocms (npm): upgrade to 0.2.0 or later
```
npm install studiocms@0.2.0
```

Technical details

The vulnerability is a Broken Object Level Authorization (BOLA) flaw in the /dashboard/content-management/edit endpoint that validates user authentication but fails to enforce role-based access control (RBAC) or content ownership verification. An authenticated user with the "Visitor" role can directly access draft content by providing the content UUID in the query parameter, bypassing checks that should require Editor/Admin/Owner privileges. The root cause is missing authorization validation on the endpoint. Attack vector is network-based and requires only valid authentication as a low-privilege user; no additional user interaction is needed. An attacker can read any draft content, achieving full information disclosure. The vulnerability was patched in version 0.2.0; affected versions are <=0.1.1.

Affected products

StudioCMS StudioCMS <=0.1.1

Identifiers

CVE-2026-24134
GHSA-8cw6-53m5-4932

Timeline

2026-01-27: disclosed
2026-01-27: patched: Fixed in version 0.2.0

References

https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.