7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30945

CVE-2026-30945: StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations. This vulnerability is fixed in 0.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30945

CVE-2026-30945:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
studiocms	npm	<= 0.3.0	0.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis is based on the detailed description provided, which includes the exact vulnerable code snippet from version 0.3.0 of StudioCMS. The vulnerability lies in the DELETE handler for the API token revocation endpoint. The code authorizes any user with 'editor' privileges to perform the action but critically fails to check if the user is revoking their own token. It directly uses the userID and tokenID from the request body to call the sdk.REST_API.tokens.delete function. This allows a lower-privileged user (an editor) to cause a denial of service by revoking API tokens of higher-privileged users (admins, owners).

The fixing commit 9eec9c3b45523b635cfe16d55aa55afabacbebe3 corroborates this analysis. The patch refactors the token revocation logic into two distinct handlers. The standard revokeApiToken handler is modified to exclusively use the authenticated user's ID from their session (userData.user.id), preventing them from specifying another user's ID. A new, separate handler, adminRevokeUserApiToken, is introduced for administrators, which includes proper permission and hierarchy checks to ensure that only authorized admins can revoke tokens belonging to other users, and only if the target user has a lower permission level. This confirms that the original logic was flawed as described.

Vulnerable functions

DELETE

packages/studiocms/frontend/pages/studiocms_api/dashboard/api-tokens.ts

The function, which handles DELETE requests for the `/studiocms_api/dashboard/api-tokens` endpoint, is vulnerable to an Insecure Direct Object Reference (IDOR). It checks if the authenticated user has 'editor' privileges but fails to validate that the `userID` provided in the request body matches the ID of the authenticated user. This allows any user with editor permissions to revoke API tokens belonging to any other user, including administrators and owners, by simply providing the target's `userID` and a valid `tokenID` in the request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.