CVE-2026-32106: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32106 is an improper privilege management vulnerability in StudioCMS, a server-side-rendered, Astro-native headless CMS. The flaw exists in the REST API createUser endpoint, which uses inconsistent rank validation logic compared to the Dashboard API, allowing an authenticated admin to create additional admin-level accounts. All versions up to and including 0.4.2 are affected; the issue was disclosed on March 11, 2026, and fixed in version 0.4.3. The CVSS v3.1 base score is 4.7 (Moderate) per the GitHub Advisory, though Feedly's assessment rates it 7.2 (High) (GitHub Advisory, StudioCMS Advisory).

The root cause is CWE-269 (Improper Privilege Management) stemming from an inconsistency between two API handlers. The REST API handler in packages/studiocms/frontend/pages/studiocms_api/_handlers/rest-api/v1/secure.ts uses string-based equality checks that only block creation of owner-ranked accounts, with no check preventing an admin from creating a peer admin. In contrast, the Dashboard API handler in _handlers/dashboard/create.ts correctly uses indexOf-based comparison against the availablePermissionRanks array (['unknown', 'visitor', 'editor', 'admin', 'owner']) to block creation of any user at or above the caller's rank. An attacker with a valid admin-level API token can send a crafted POST request to /studiocms_api/rest/v1/secure/users with "rank": "admin" and receive a 200 OK response instead of the expected 403 Forbidden (StudioCMS Advisory, GitHub Advisory).

A compromised or rogue admin can exploit this vulnerability to create additional admin accounts that serve as persistence mechanisms, surviving password resets or API token revocations on the original account. This enables privilege proliferation within the CMS, potentially allowing unauthorized content modification, data access, and sustained unauthorized access even after incident response actions. The practical severity is limited by the requirement for existing admin-level access (PR:H), but the impact on integrity and persistence within the affected system is significant (StudioCMS Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a concrete curl command targeting the vulnerable REST API endpoint. The EPSS score is approximately 0.025% (0.031% per Feedly), indicating low probability of near-term exploitation. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid admin-level API bearer token, which significantly limits the attack surface (StudioCMS Advisory, GitHub Advisory).

1. Obtain admin credentials: Acquire a valid admin-level API bearer token for the target StudioCMS instance (e.g., through credential theft, phishing, or compromise of an existing admin account).
2. Identify the target endpoint: Locate the REST API createUser endpoint at /studiocms_api/rest/v1/secure/users on the target StudioCMS deployment.
3. Craft the malicious request: Prepare a POST request with the Authorization: Bearer <admin_token> header and a JSON payload specifying "rank": "admin" for the new user account.
4. Send the request: Execute the following command:

curl -X POST 'http://<target>:4321/studiocms_api/rest/v1/secure/users' \
  -H 'Authorization: Bearer <admin_token>' \
  -H 'Content-Type: application/json' \
  -d '{"username": "rogue_admin", "email": "rogue@attacker.com", "displayname": "Rogue Admin", "rank": "admin", "password": "StrongP@ssw0rd123"}'

5. Confirm account creation: A 200 OK response confirms the new admin account was created successfully, bypassing the expected 403 Forbidden restriction.
6. Establish persistence: Use the newly created admin account as a backdoor that persists even if the original compromised account's credentials are rotated or revoked (StudioCMS Advisory).

• Network: Unexpected POST requests to /studiocms_api/rest/v1/secure/users from admin-authenticated sessions, particularly outside normal administrative hours or from unusual source IPs.
• Logs: Application logs showing 200 OK responses to POST /studiocms_api/rest/v1/secure/users with a rank field set to admin; multiple admin account creation events in a short timeframe.
• Application: Presence of unexpected admin-level user accounts in the StudioCMS user database, especially accounts with unfamiliar usernames, email addresses, or creation timestamps that do not correspond to legitimate administrative activity (StudioCMS Advisory).

Upgrade StudioCMS to version 0.4.3 or later, which replaces the string-based rank checks in the REST API handler with the correct indexOf-based comparison used by the Dashboard API. As an interim workaround, restrict network access to the /studiocms_api/rest/v1/secure/users endpoint to only trusted IP ranges, and audit existing admin accounts for any unauthorized entries. Monitor account creation events via application logs for any unauthorized admin account provisioning (StudioCMS Advisory, GitHub Advisory).