CVE-2026-32106
Last modified
CVE-2026-32106 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts via the REST API, enabling privilege proliferation and persistence. This vulnerability is fixed in 0.4.3.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Studiocms | Studiocms | < 0.4.3 |
References
- https://github.com/withstudiocms/studiocms/security/advisories/GHSA-wj56-g96r-673qExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-32106?
How severe is CVE-2026-32106?
How do I fix CVE-2026-32106?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-32100Shopware is an open commerce platform. /api/_info/config rou…5.3
- CVE-2026-32101StudioCMS is a server-side-rendered, Astro native, headless …6.3
- CVE-2026-32102OliveTin gives access to predefined shell commands from a we…6.5
- CVE-2026-32103StudioCMS is a server-side-rendered, Astro native, headless …7.2
- CVE-2026-32104StudioCMS is a server-side-rendered, Astro native, headless …5.4
- CVE-2026-32105xrdp is an open source RDP server. In versions through 0.10.…7.7
- CVE-2026-32107xrdp is an open source RDP server. In versions through 0.10.…8.8
- CVE-2026-32108Copyparty is a portable file server. Prior to 1.20.12, there…6.5
- CVE-2026-32109Copyparty is a portable file server. Prior to 1.20.12, if an…4.4
- CVE-2026-3211Cross-Site Request Forgery (CSRF) vulnerability in Drupal Th…4.3
- CVE-2026-32110SiYuan is a personal knowledge management system. Prior to 3…8.3
- CVE-2026-32111ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the h…5.3
Are you affected by CVE-2026-32106?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST