CVE-2026-24134

StudioCMS has an Authorization Bypass Through User-Controlled Key

StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/Owner users. Version 0.2.0 patches the issue.

Affected

withstudiocms · studiocms

CVSS v3.1 GITHUB

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 25th percentile

Published

2026-01-27

Updated

2026-01-28

Proof-of-concept exploits (2)

• advisories/GHSA-8cw6-53m5-4932
• FilipeGaudard/CVE-2026-24134-PoC0★ · 2026-01-29

Security advisories

• withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932
• withstudiocms/studiocms/commit/efc10bee20db090fdd75463622c30dda390c50ad

References

• CVE Record
• NVD entry

Related

• CVE-2026-30944
• CVE-2026-30945
• CVE-2026-33149
• CVE-2026-35045