CVE-2026-30945: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30945 is an Insecure Direct Object Reference (IDOR) vulnerability in StudioCMS, an Astro-native headless content management system, that allows any authenticated user with editor-level privileges or above to arbitrarily revoke API tokens belonging to any other user — including admin and owner accounts. It affects all StudioCMS versions up to and including 0.3.0 (npm package studiocms), and was disclosed on March 10, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Github Advisory, StudioCMS Advisory).

The root cause is a broken access control flaw (CWE-639: Authorization Bypass Through User-Controlled Key; CWE-863: Incorrect Authorization) in the server-side handler for the DELETE /studiocms_api/dashboard/api-tokens endpoint. The handler only checks whether the caller holds isEditor status, then accepts tokenID and userID directly from the attacker-controlled JSON request body without verifying token ownership, comparing the supplied userID against the authenticated session, or enforcing role hierarchy — both values are passed directly to sdk.REST_API.tokens.delete(). This makes it a textbook IDOR: an editor can supply any target user's UUID and any token UUID to trigger deletion, including tokens belonging to admins or owners (StudioCMS Advisory, Github Advisory).

A malicious editor-level user can silently revoke API tokens belonging to any account, including the highest-privileged owner accounts, causing denial of service against CI/CD pipelines, third-party integrations, monitoring systems, and other automated workflows that depend on those tokens. There is no confidentiality impact (tokens are not exposed, only deleted), but integrity is lowered through unauthorized modification of token state, and availability is highly impacted as automated systems lose authentication credentials without warning. Attribution is difficult because the revocation is processed as a legitimate operation, leaving minimal audit trail unless detailed request logging is in place (StudioCMS Advisory).

A public proof-of-concept Python script (cve_2026_30945_poc.py) is available on GitHub, supporting both manual and automated modes to send DELETE requests revoking arbitrary users' tokens via the IDOR vulnerability (PoC Repository). The official security advisory also provides explicit step-by-step exploitation instructions including the exact HTTP request format, headers, and payload (StudioCMS Advisory). As of the time of reporting, there is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.054% (17th percentile), indicating low but non-zero exploitation probability (Github Advisory).

1. Obtain editor-level credentials: Acquire a valid session for a StudioCMS account with at least editor privileges (e.g., through legitimate registration, social engineering, or credential theft).
2. Identify target user and token UUIDs: Browse the StudioCMS dashboard or enumerate the API to discover the target user's UUID and their associated API token UUIDs. Token IDs are internal record identifiers (UUIDs), not JWT values.
3. Craft the DELETE request: Construct an HTTP DELETE request to the vulnerable endpoint with the target's identifiers in the JSON body:

DELETE /studiocms_api/dashboard/api-tokens HTTP/1.1
Host: <target>
Cookie: auth_session=<editor_session_cookie>
Content-Type: application/json
Accept: application/json

{
  "tokenID": "<target_token_uuid>",
  "userID": "<target_user_uuid>"
}

4. Send the request: Transmit the request. The server performs no ownership or role hierarchy check and responds with HTTP 200 {"message":"Token deleted"}.
5. Achieve denial of service: The target user's API token is permanently revoked. Any CI/CD pipelines, integrations, or automations relying on that token will immediately begin failing authentication (StudioCMS Advisory, PoC Repository).

• Network: Unexpected HTTP DELETE requests to /studiocms_api/dashboard/api-tokens originating from editor-level user sessions, particularly where the userID in the payload does not match the authenticated session's user ID; repeated DELETE requests targeting multiple token UUIDs in rapid succession.
• Logs: Web server or application access logs showing DELETE requests to the API token endpoint with JSON payloads containing mismatched userID values relative to the session owner; HTTP 200 responses to such requests from non-admin accounts.
• Application Behavior: Sudden, unexplained failures in CI/CD pipelines, third-party integrations, or monitoring systems due to API authentication errors; API tokens for admin or owner accounts disappearing without corresponding admin-initiated revocation events.
• Audit Trail: Absence of expected audit log entries for token revocation (since the operation is processed as legitimate), combined with integration failures, may indicate exploitation (StudioCMS Advisory).

Upgrade StudioCMS to version 0.4.0 or later, which introduces a dedicated admin-level API token revocation endpoint (DELETE /studiocms_api/dashboard/api-tokens/admin) with proper permission checks, token ownership verification, and role hierarchy enforcement (StudioCMS Release, Patch Commit). For systems that cannot be immediately updated, implement network-level access controls to restrict access to the /studiocms_api/dashboard/api-tokens endpoint, audit API token usage for unauthorized revocations, and limit editor-level privileges to only trusted users (Github Advisory).

The vulnerability was reported by security researcher FilipeGaudard and remediated by StudioCMS maintainer Adammatthiesen, who published the advisory and patch on March 10, 2026 (StudioCMS Advisory). FilipeGaudard also published a public PoC exploit shortly after disclosure (PoC Repository). No significant broader media coverage or notable community debate has been identified beyond the standard CVE tracking and advisory publication.