CVE-2026-24134: Studiocms StudioCMS Has Authorization Bypass Through Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8cw6-53m5-4932",
  "modified" : "2026-01-29T03:43:54Z",
  "published" : "2026-01-27T22:13:52Z",
  "aliases" : [ "CVE-2026-24134" ],
  "summary" : "StudioCMS has Authorization Bypass Through User-Controlled Key",
  "details" : "### Summary\nStudioCMS contains a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the \"Visitor\" role to access draft content created by Editor/Admin/Owner users.\n\n### Details\n**The Issue:**\nThe endpoint `/dashboard/content-management/edit?edit={UUID}` validates user authentication but does NOT validate:\n1. User role (should require Editor/Admin/Owner)\n2. Content ownership (should verify the draft belongs to the user)\n\nThis allows users with \"Visitor\" role (lowest privilege) to access draft content created by Editor/Admin/Owner users by directly accessing the edit URL with the content UUID.\n\n### PoC\n   - **User A:** Editor role (example username: `dummy04`)\n   - **User B:** Visitor role (example username: `dummy01`)\n\n**Reproduction Steps:**\n\n**Step 1 - Create draft as Editor:**\n\n1. Login as User A (Editor role)\n2. Navigate to: `http://localhost:4321/dashboard/content-management`\n3. Create new content (it will stay as draft)\n4. After saving, note the UUID in the URL:\n````\n   http://localhost:4321/dashboard/content-management/edit?edit=bad87630-69a4-4cd6-bcb2-6965839dc148\n````\n   Copy this UUID: `bad87630-69a4-4cd6-bcb2-6965839dc148`\n\n**Step 2 - Access draft as Visitor:**\n\n1. Login as Visitor and get auth_session cookie\n```\ncurl -X POST \"http://127.0.0.1:4321/studiocms_api/auth/login\" -F 'username=dummy01' -F 'password=dummy01pass$'\n```\n<img width=\"1128\" height=\"376\" alt=\"01\" src=\"https://github.com/user-attachments/assets/86c5290e-e7a2-470e-bbf5-5f5247eddec1\" />\n\n2. Proof of Visitor permission\n<img width=\"1899\" height=\"450\" alt=\"02\" src=\"https://github.com/user-attachments/assets/aabd47d3-163f-4a56-8296-08bd40c5ccdc\" />\n\n3. Access Editor's draft using the UUID\n```\ncurl \"http://127.0.0.1:4321/dashboard/content-management/edit?edit=bad87630-69a4-4cd6-bcb2-6965839dc148\" -H \"Cookie: auth_session=qvawh6zv23hc2spu6xx7pzgrnn4rpd3q\" -v\n```\n\n**Result:** Returns full HTML page with draft content (200 OK)\n\n### Impact\n**Impact Scenarios:**\n\n1. **Information Disclosure:**\n   - Visitor users can read unpublished drafts containing sensitive information\n   - Drafts may contain confidential business information, unreleased announcements, or proprietary content\n   - Competitive intelligence could be gathered from draft content\n\n2. **Privacy Violation:**\n   - Personal notes, work-in-progress content, or internal communications in drafts exposed\n   - Violation of content creator privacy expectations\n\n3. **Business Impact:**\n   - Premature disclosure of marketing campaigns, product launches, or announcements\n   - Loss of competitive advantage if draft strategies are exposed\n   - Potential compliance issues if drafts contain regulated information\n\n4. **Complete RBAC Bypass:**\n   - The entire role-based access control system for draft content is bypassed\n   - \"Visitor\" role becomes equivalent to \"Editor\" for read access to drafts\n   - Undermines the trust model of multi-user content management",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "studiocms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.2.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-24134"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withstudiocms/studiocms/commit/efc10bee20db090fdd75463622c30dda390c50ad"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/withstudiocms/studiocms"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.2.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-639", "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-27T22:13:52Z",
    "nvd_published_at" : "2026-01-28T00:15:50Z"
  }
}