studiocms

StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

StudioCMS has Authorization Bypass Through User-Controlled Key

StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings

StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation

StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

StudioCMS has Privilege Escalation via Insecure API Token Generation

StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens

StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check