CVE-2026-24134

Description

StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/Owner users. Version 0.2.0 patches the issue.

PUBLISHED Reserved 2026-01-21 | Published 2026-01-27 | Updated 2026-01-28 | Assigner GitHub_M

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-862: Missing Authorization

Product status

References

github.com/...diocms/security/advisories/GHSA-8cw6-53m5-4932

github.com/...ommit/efc10bee20db090fdd75463622c30dda390c50ad

github.com/...udiocms/studiocms/releases/tag/studiocms@0.2.0

cve.org (CVE-2026-24134)

nvd.nist.gov (CVE-2026-24134)

Download JSON