CVE-2026-32638

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the attacker-controlled `rank` query parameter to decide whether owner accounts should be filtered from the result set. As a result, an admin token can request `rank=owner` and receive owner account records, including IDs, usernames, display names, and email addresses, even though the adjacent `getUser` endpoint correctly blocks admins from viewing owner users. This is an authorization inconsistency inside the same user-management surface. Version 0.4.4 fixes the issue.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
withstudiocms	studiocms	< 0.4.4

References

https://github.com/withstudiocms/studiocms/commit/aebe8bcb3618bb07c6753e3f5c982c1fe6adea64Patch
https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.4Product, Release Notes
https://github.com/withstudiocms/studiocms/security/advisories/GHSA-xvf4-ch4q-2m24Exploit, Mitigation, Vendor Advisory

Timeline

Published: Mar 18, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-326396.8Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Them CVE-2026-32648.8A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. Affected by this issue is some unknown CVE-2026-326409.8SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak danger CVE-2026-326417.5Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs use CVE-2026-326424.3Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire pro CVE-2026-326438.7A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager CVE-2026-326449.8Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.CVE-2026-326456.0Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.CVE-2026-326467.5A specific administrative endpoint is accessible without proper authentication, exposing device management functions.CVE-2026-326477.8NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer o CVE-2026-326485.3Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisti CVE-2026-326496.8A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras.