Is CVE-2026-30944 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30944 being exploited in the wild.

How severe is CVE-2026-30944?

Low severity, with a CVSS score of 3.1, published 10 March 2026.

Which products and versions are affected?

studiocms (npm) SEMVER:introduced=0,fixed=0.4.0.

Is there a fix for CVE-2026-30944?

Yes. studiocms (npm): upgrade to 0.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30944 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-30944?

Check whether you run studiocms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30944: StudioCMS privilege escalation via insecure API token generation

CVE-2026-30944 · Severity: low · CVSS 3.1 · Published 2026-03-10

StudioCMS is a content management system that provides REST API functionality for managing site content and users. The API token generation endpoint contains an authorization flaw that allows any authenticated editor to generate API tokens on behalf of any other user, including site administrators and owners. An attacker with basic editor access can escalate to owner-level privileges, gaining full control over the CMS and access to all user data and content.

Technologies: studiocms (npm). Vendors: npm.

Quick answers

Is CVE-2026-30944 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30944 being exploited in the wild.
How severe is CVE-2026-30944?: Low severity, with a CVSS score of 3.1, published 10 March 2026.
Which products and versions are affected?: studiocms (npm) SEMVER:introduced=0,fixed=0.4.0.
Is there a fix for CVE-2026-30944?: Yes. studiocms (npm): upgrade to 0.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30944 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-30944?: Check whether you run studiocms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

studiocms (npm): upgrade to 0.4.0 or later
```
npm install studiocms@0.4.0
```

Technical details

This is a broken object-level authorization (BOLA) vulnerability in the POST /studiocms_api/dashboard/api-tokens endpoint. The endpoint accepts a "user" parameter in the request body to specify which user should receive the generated API token, but performs insufficient authorization checks: it only verifies that the caller is logged in and has editor-or-above permissions, but does not validate that the caller is authorized to generate tokens on behalf of the specified target user. The vulnerable code passes the user parameter directly to the token generation function without comparing it against the authenticated user's identity. An authenticated editor can specify an arbitrary user UUID (including owner or admin accounts) in the request body and receive a valid JWT token bound to that account. This token grants full REST API access with the impersonated user's privileges. Patch version 0.4.0 is available.

Affected products

StudioCMS StudioCMS <=0.3.0

Identifiers

CVE-2026-30944
GHSA-667w-mmh7-mrr4

Timeline

2026-03-10: disclosed
2026-03-10: patched: Version 0.4.0 contains the fix

References

https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.