Is CVE-2026-32103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32103 being exploited in the wild.

How severe is CVE-2026-32103?

Low severity, with a CVSS score of 3.1, published 12 March 2026.

Which products and versions are affected?

studiocms (npm) SEMVER:introduced=0,fixed=0.4.3.

Is there a fix for CVE-2026-32103?

Yes. studiocms (npm): upgrade to 0.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32103 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-32103?

Check whether you run studiocms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32103: StudioCMS IDOR admin-to-owner account takeover via password reset

CVE-2026-32103 · Severity: low · CVSS 3.1 · Published 2026-03-12

StudioCMS is a content management system used to manage website content, users, and configuration. An authenticated admin user can bypass authorization checks to generate a password reset token for the owner account, then use that token to change the owner's password and take over the entire system. This allows an insider admin to seize full control of the CMS and all hosted content.

Technologies: studiocms (npm). Vendors: npm.

Quick answers

Is CVE-2026-32103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32103 being exploited in the wild.
How severe is CVE-2026-32103?: Low severity, with a CVSS score of 3.1, published 12 March 2026.
Which products and versions are affected?: studiocms (npm) SEMVER:introduced=0,fixed=0.4.3.
Is there a fix for CVE-2026-32103?: Yes. studiocms (npm): upgrade to 0.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32103 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-32103?: Check whether you run studiocms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

studiocms (npm): upgrade to 0.4.3 or later
```
npm install studiocms@0.4.3
```

Technical details

The vulnerability is an insecure direct object reference (IDOR) combined with insufficient authorization checks in the POST /studiocms_api/dashboard/create-reset-link endpoint. The endpoint verifies the caller is an admin but fails to enforce two critical checks: it does not validate that the target userId matches the caller's identity, and it does not verify role hierarchy to prevent lower-privileged admins from targeting higher-privileged accounts. An authenticated admin attacker can specify any user's UUID (including the owner) in the request body, and the server will generate a valid password reset JWT token that is returned in the response. This token can then be used with the reset-password endpoint to set an arbitrary password for the owner account, completing full account takeover. The attack requires admin authentication but no user interaction on the victim's part.

Affected products

withstudiocms StudioCMS <=0.4.2

Identifiers

CVE-2026-32103
GHSA-h7vr-cg25-jf8c

Timeline

2026-03-11: disclosed
2026-03-12: advisory
2026-03-12: patched: Version 0.4.3 patches the vulnerability

References

https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.