Is CVE-2026-30945 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30945 being exploited in the wild.

How severe is CVE-2026-30945?

Low severity, with a CVSS score of 3.1, published 11 March 2026.

Which products and versions are affected?

studiocms (npm) SEMVER:introduced=0,fixed=0.4.0.

Is there a fix for CVE-2026-30945?

Yes. studiocms (npm): upgrade to 0.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30945 attacked?

It is attacked over the network.

Am I affected by CVE-2026-30945?

Check whether you run studiocms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30945: StudioCMS IDOR in API token revocation

CVE-2026-30945 · Severity: low · CVSS 3.1 · Published 2026-03-11

StudioCMS is a content management system with API token management features. An insecure endpoint allows any editor-level user to revoke API tokens belonging to any other user, including administrators and owners. This can cause denial of service by silently disabling automated workflows, CI/CD pipelines, and third-party integrations that depend on those tokens.

Technologies: studiocms (npm). Vendors: npm.

Quick answers

Is CVE-2026-30945 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30945 being exploited in the wild.
How severe is CVE-2026-30945?: Low severity, with a CVSS score of 3.1, published 11 March 2026.
Which products and versions are affected?: studiocms (npm) SEMVER:introduced=0,fixed=0.4.0.
Is there a fix for CVE-2026-30945?: Yes. studiocms (npm): upgrade to 0.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30945 attacked?: It is attacked over the network.
Am I affected by CVE-2026-30945?: Check whether you run studiocms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

studiocms (npm): upgrade to 0.4.0 or later
```
npm install studiocms@0.4.0
```

Technical details

The DELETE /studiocms_api/dashboard/api-tokens endpoint implements an Insecure Direct Object Reference (IDOR) vulnerability. The handler verifies only that the caller is logged in and holds editor-level privileges, but fails to validate token ownership, caller identity against the target user, or role hierarchy. An authenticated editor can supply arbitrary tokenID and userID parameters in the request JSON payload; both are passed directly to the SDK's token deletion function without server-side ownership checks. This allows a lower-privileged user to revoke tokens belonging to higher-privileged accounts (admin, owner). The attack requires network access and valid authentication credentials; no user interaction is needed. The patch is available in version 0.4.0.

Affected products

StudioCMS StudioCMS <=0.3.0

Identifiers

CVE-2026-30945
GHSA-8rgj-vrfr-6hqr

Timeline

2026-03-10: disclosed
2026-03-11: advisory
2026-03-11: patched: version 0.4.0

References

https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8rgj-vrfr-6hqr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.