studiocms

StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens

StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

StudioCMS has Authorization Bypass Through User-Controlled Key

StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation

StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

StudioCMS has Privilege Escalation via Insecure API Token Generation

StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings

StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check