Executive brief
StudioCMS is a content management system with REST API endpoints for user management. The getUsers endpoint fails to properly restrict admin accounts from viewing owner user records, allowing enumeration of owner email addresses and account details. This creates a phishing and account-targeting risk if owner accounts are treated as higher-privilege principals than admins.
Technical details
The vulnerability is an authorization inconsistency (CWE-639) in the REST API getUsers endpoint. The handler uses an attacker-controlled rank query parameter to decide whether to filter owner accounts, rather than checking the caller's privilege level. An admin with a valid REST API token can pass rank=owner to bypass the owner-filtering branch and enumerate owner records (ID, email, username, display name). The adjacent getUser endpoint correctly blocks admins from viewing owner records, demonstrating that getUsers bypasses the intended security boundary. Requires valid admin REST API token and network access to the API endpoint. Patch is available in version 0.4.4.
Affected products
- StudioCMS StudioCMS <=0.4.3
Timeline
- 2026-03-16: disclosed
- 2026-03-16: patched: Version 0.4.4 released with fix