Executive brief
StudioCMS is a content management system that provides REST API functionality for managing site content and users. The API token generation endpoint contains an authorization flaw that allows any authenticated editor to generate API tokens on behalf of any other user, including site administrators and owners. An attacker with basic editor access can escalate to owner-level privileges, gaining full control over the CMS and access to all user data and content.
Technical details
This is a broken object-level authorization (BOLA) vulnerability in the POST /studiocms_api/dashboard/api-tokens endpoint. The endpoint accepts a "user" parameter in the request body to specify which user should receive the generated API token, but performs insufficient authorization checks: it only verifies that the caller is logged in and has editor-or-above permissions, but does not validate that the caller is authorized to generate tokens on behalf of the specified target user. The vulnerable code passes the user parameter directly to the token generation function without comparing it against the authenticated user's identity. An authenticated editor can specify an arbitrary user UUID (including owner or admin accounts) in the request body and receive a valid JWT token bound to that account. This token grants full REST API access with the impersonated user's privileges. Patch version 0.4.0 is available.
Affected products
- StudioCMS StudioCMS <=0.3.0
Timeline
- 2026-03-10: disclosed
- 2026-03-10: patched: Version 0.4.0 contains the fix