GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
8 advisories
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
Low
CVE-2026-32638
was published
for
studiocms
(npm)
Mar 16, 2026
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts
Moderate
CVE-2026-32106
was published
for
studiocms
(npm)
Mar 12, 2026
StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings
Moderate
CVE-2026-32104
was published
for
studiocms
(npm)
Mar 12, 2026
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation
Moderate
CVE-2026-32103
was published
for
studiocms
(npm)
Mar 12, 2026
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
High
CVE-2026-32101
was published
for
@studiocms/s3-storage
(npm)
Mar 12, 2026
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service
High
CVE-2026-30945
was published
for
studiocms
(npm)
Mar 11, 2026
StudioCMS has Privilege Escalation via Insecure API Token Generation
High
CVE-2026-30944
was published
for
studiocms
(npm)
Mar 10, 2026
StudioCMS has Authorization Bypass Through User-Controlled Key
Moderate
CVE-2026-24134
was published
for
studiocms
(npm)
Jan 27, 2026
ProTip!
Advisories are also available from the
GraphQL API