Executive brief
StudioCMS is a content management system used to manage website content, users, and configuration. An authenticated admin user can bypass authorization checks to generate a password reset token for the owner account, then use that token to change the owner's password and take over the entire system. This allows an insider admin to seize full control of the CMS and all hosted content.
Technical details
The vulnerability is an insecure direct object reference (IDOR) combined with insufficient authorization checks in the POST /studiocms_api/dashboard/create-reset-link endpoint. The endpoint verifies the caller is an admin but fails to enforce two critical checks: it does not validate that the target userId matches the caller's identity, and it does not verify role hierarchy to prevent lower-privileged admins from targeting higher-privileged accounts. An authenticated admin attacker can specify any user's UUID (including the owner) in the request body, and the server will generate a valid password reset JWT token that is returned in the response. This token can then be used with the reset-password endpoint to set an arbitrary password for the owner account, completing full account takeover. The attack requires admin authentication but no user interaction on the victim's part.
Affected products
- withstudiocms StudioCMS <=0.4.2
Timeline
- 2026-03-11: disclosed
- 2026-03-12: advisory
- 2026-03-12: patched: Version 0.4.3 patches the vulnerability