Executive brief
StudioCMS is a content management system with API token management features. An insecure endpoint allows any editor-level user to revoke API tokens belonging to any other user, including administrators and owners. This can cause denial of service by silently disabling automated workflows, CI/CD pipelines, and third-party integrations that depend on those tokens.
Technical details
The DELETE /studiocms_api/dashboard/api-tokens endpoint implements an Insecure Direct Object Reference (IDOR) vulnerability. The handler verifies only that the caller is logged in and holds editor-level privileges, but fails to validate token ownership, caller identity against the target user, or role hierarchy. An authenticated editor can supply arbitrary tokenID and userID parameters in the request JSON payload; both are passed directly to the SDK's token deletion function without server-side ownership checks. This allows a lower-privileged user to revoke tokens belonging to higher-privileged accounts (admin, owner). The attack requires network access and valid authentication credentials; no user interaction is needed. The patch is available in version 0.4.0.
Affected products
- StudioCMS StudioCMS <=0.3.0
Timeline
- 2026-03-10: disclosed
- 2026-03-11: advisory
- 2026-03-11: patched: version 0.4.0