CVE-2026-24134: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24134 is a Broken Object Level Authorization (BOLA) vulnerability in StudioCMS, an npm-based content management system, that allows authenticated users with the "Visitor" role to read unpublished draft content created by Editor, Admin, or Owner users. The vulnerability affects all StudioCMS versions prior to 0.2.0 (specifically confirmed through version 0.1.1). It was disclosed on January 27, 2026, via a GitHub Security Advisory, and published to the NVD on January 28, 2026. The CVSS v3.1 base score is 6.5 (Medium) (GitHub Advisory, StudioCMS Advisory).

The root cause is a missing authorization check (CWE-862) combined with an authorization bypass through a user-controlled key (CWE-639) in the /dashboard/content-management/edit?edit={UUID} endpoint. While the endpoint correctly validates that a user is authenticated, it fails to verify the user's role or content ownership — meaning any authenticated user, regardless of role, can supply a known content UUID to access draft content. The fix, implemented in commit efc10be, reworks permission checks to the middleware level using a route-to-permission-level mapping, ensuring that /dashboard/content-management/** routes require at minimum the "editor" permission level (GitHub Advisory, Patch Commit).

Successful exploitation results in high confidentiality impact with no effect on integrity or availability. Authenticated Visitor-role users can read any unpublished draft content by supplying its UUID, effectively bypassing the entire RBAC system and gaining read access equivalent to the Editor role for draft content. This can expose confidential business information, unreleased marketing campaigns, product announcements, proprietary strategies, and potentially regulated data, leading to competitive disadvantage, privacy violations, and possible compliance issues (GitHub Advisory).

A public proof-of-concept exploit is available on GitHub (published by FilipeGaudard, the original reporter, around March 2, 2026), and the official security advisory itself includes detailed reproduction steps (GitHub Advisory, PoC). The vulnerability requires only low privileges (a valid Visitor-role account) and no user interaction, making it straightforward to exploit. The EPSS score is approximately 0.027% (0.051% per GitHub Advisory), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time (GitHub Advisory).

1. Obtain a Visitor-role account: Register or obtain credentials for a low-privilege "Visitor" account on the target StudioCMS instance.
2. Authenticate and capture session cookie: Send a POST request to the login endpoint to obtain a valid session cookie:

   curl -X POST "http://<target>/studiocms_api/auth/login" -F 'username=visitoruser' -F 'password=visitorpass'

   Note the returned auth_session cookie value.
3. Identify draft content UUIDs: Obtain a UUID for a draft content item. This may be discovered through social engineering, information leakage in other responses, or by enumerating UUIDs (e.g., via brute force or predictable patterns if applicable).
4. Access the draft content: Use the captured session cookie to directly request the edit endpoint with the target UUID:

   curl "http://<target>/dashboard/content-management/edit?edit=<UUID>" -H "Cookie: auth_session=<session_token>" -v

5. Retrieve draft content: The server returns a 200 OK response with the full HTML page containing the unpublished draft content, bypassing all RBAC checks (GitHub Advisory, StudioCMS Advisory).

• Network: Unusual HTTP GET requests to /dashboard/content-management/edit?edit=<UUID> from accounts with Visitor-role session tokens; repeated requests to this endpoint with varying UUID values from the same session (potential enumeration).
• Logs: Web server access logs showing 200 OK responses to /dashboard/content-management/edit endpoints for sessions belonging to Visitor-role users; authentication logs showing Visitor-role logins followed immediately by content-management endpoint access.
• Application Behavior: Visitor-role users accessing dashboard routes that should be restricted to Editor/Admin/Owner roles; unexpected access patterns to draft content outside of normal publishing workflows (GitHub Advisory).

Upgrade StudioCMS to version 0.2.0 or later, which implements middleware-level permission checks for all dashboard routes, ensuring /dashboard/content-management/** requires at minimum the "editor" permission level (StudioCMS Release, Patch Commit). No configuration-based workaround is available for unpatched versions; upgrading is the only remediation. After upgrading, review access logs to identify any Visitor-role access to draft content during the vulnerability window, and audit or rotate any sensitive information that may have been exposed in drafts (GitHub Advisory).

The vulnerability was reported by FilipeGaudard and remediated by Adammatthiesen (StudioCMS maintainer), with the fix released the same day as disclosure on January 27, 2026. The advisory was picked up by standard vulnerability aggregators including Vulners, CVEFeed, and VulDB shortly after publication. No significant broader media coverage or notable researcher commentary beyond the official advisory and PoC publication has been identified (GitHub Advisory).