# CVE-2026-32638: StudioCMS REST getUsers authorization bypass

Source: https://junglewise.ai/threats/cve-2026-32638-studiocms-rest-getusers-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-32638 · Severity: low · CVSS 3.1 · Published 2026-03-16

StudioCMS is a content management system with REST API endpoints for user management. The getUsers endpoint fails to properly restrict admin accounts from viewing owner user records, allowing enumeration of owner email addresses and account details. This creates a phishing and account-targeting risk if owner accounts are treated as higher-privilege principals than admins.

Technologies: [studiocms (npm)](https://junglewise.ai/threats/technologies/studiocms). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-32638 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32638 being exploited in the wild.

**How severe is CVE-2026-32638?** Low severity, with a CVSS score of 3.1, published 16 March 2026.

**Which products and versions are affected?** studiocms (npm) SEMVER:introduced=0,fixed=0.4.4.

**Is there a fix for CVE-2026-32638?** Yes. studiocms (npm): upgrade to 0.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32638 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-32638?** Check whether you run studiocms (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- studiocms (npm): upgrade to 0.4.4 or later

  ```sh
  npm install studiocms@0.4.4
  ```


## Technical details

The vulnerability is an authorization inconsistency (CWE-639) in the REST API getUsers endpoint. The handler uses an attacker-controlled rank query parameter to decide whether to filter owner accounts, rather than checking the caller's privilege level. An admin with a valid REST API token can pass rank=owner to bypass the owner-filtering branch and enumerate owner records (ID, email, username, display name). The adjacent getUser endpoint correctly blocks admins from viewing owner records, demonstrating that getUsers bypasses the intended security boundary. Requires valid admin REST API token and network access to the API endpoint. Patch is available in version 0.4.4.

## Affected products

- StudioCMS StudioCMS <=0.4.3

## Identifiers

- CVE-2026-32638
- GHSA-xvf4-ch4q-2m24

## Timeline

- 2026-03-16: disclosed
- 2026-03-16: patched: Version 0.4.4 released with fix

## References

- [https://github.com/withstudiocms/studiocms/security/advisories/GHSA-xvf4-ch4q-2m24](https://github.com/withstudiocms/studiocms/security/advisories/GHSA-xvf4-ch4q-2m24)

## Related threats

- [StudioCMS REST API missing rank check in user creation](https://junglewise.ai/threats/cve-2026-32106-studiocms-rest-api-missing-rank-check-in-user-creation)
- [StudioCMS IDOR in user notification preferences](https://junglewise.ai/threats/cve-2026-32104-studiocms-idor-in-user-notification-preferences)
- [StudioCMS IDOR admin-to-owner account takeover via password reset](https://junglewise.ai/threats/cve-2026-32103-studiocms-idor-admin-to-owner-account-takeover-via-password-reset)
- [StudioCMS IDOR in API token revocation](https://junglewise.ai/threats/cve-2026-30945-studiocms-idor-in-api-token-revocation)
- [StudioCMS privilege escalation via insecure API token generation](https://junglewise.ai/threats/cve-2026-30944-studiocms-privilege-escalation-via-insecure-api-token-generation)