CVE-2026-32106 StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

What is CVE-2026-32106?

CVE-2026-32106 is a medium-severity vulnerability in withstudiocms studiocms, published on 11 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts via the REST API, enabling privilege proliferation and persistence. This vulnerability is fixed in 0.4.3.

Weakness: CWE-269

Which versions are affected by CVE-2026-32106?

2 open source packages ship an affected version, including studiocms. It affects 1 product.

Products include Studiocms Studiocms.

How do I fix CVE-2026-32106?

Upgrade studiocms to 0.4.3 or later.

Is CVE-2026-32106 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32106 exists.

Other vulnerabilities in withstudiocms studiocms

• CVE-2026-30944 StudioCMS Affected by Privilege Escalation via Insecure API Token Generation High 8.8
• CVE-2026-32101 StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check High 7.6
• CVE-2026-30945 StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service High 7.1
• CVE-2026-32103 StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation Medium 6.8
• CVE-2026-24134 StudioCMS has an Authorization Bypass Through User-Controlled Key Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wj56-g96r-673q.