CVE-2026-32638: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32638 is an authorization boundary bypass vulnerability in the StudioCMS REST API getUsers endpoint that allows authenticated admin-level users to enumerate owner account records, including user IDs, usernames, display names, and email addresses. It affects StudioCMS (npm package) versions 0.4.3 and earlier, with version 0.4.4 containing the fix. The vulnerability was published on March 14, 2026, and added to the GitHub Advisory Database on March 16, 2026. It carries a CVSS v3.1 base score of 2.7 (Low) (GitHub Advisory).

The root cause is an authorization logic flaw classified as CWE-639 (Authorization Bypass Through User-Controlled Key). In the getUsers handler within secure.ts, the filtering condition if (rank !== 'owner') evaluates the attacker-controlled rank query parameter rather than the caller's privilege level. An admin can pass rank=owner in the request, which causes the owner-filtering branch to be skipped, and the subsequent if (rank) branch then returns only owner accounts — directly contradicting the behavior of the adjacent getUser endpoint, which correctly enforces a rank-index comparison to block admins from viewing higher-ranked users. The fix (commit aebe8bc) replaces the flawed parameter-based check with a privilege-index comparison applied to the caller's session rank (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated admin to enumerate all owner accounts and retrieve sensitive personal data including email addresses, user IDs, usernames, display names, ranks, timestamps, and profile/avatar URLs. While there is no integrity or availability impact, the exposed owner contact data can facilitate targeted phishing campaigns, social engineering, and admin-to-owner privilege escalation attempts in deployments where owner identities are treated as higher-trust principals (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, consisting of a simple curl command requiring only a valid admin-level API token. The EPSS score is approximately 0.023% (8th percentile), indicating low predicted exploitation probability. There is no evidence of in-the-wild exploitation, no CISA KEV catalog listing, and no known threat actor attribution at this time (GitHub Advisory).

1. Obtain an admin API token: Acquire a valid admin-level REST API token for the target StudioCMS instance (e.g., through legitimate admin access, credential theft, or prior compromise).
2. Identify the target endpoint: Locate the StudioCMS REST API base URL, typically at http://<host>:<port>/studiocms_api/rest/v1/secure/users.
3. Craft the malicious request: Append the rank=owner query parameter to the getUsers endpoint to bypass the owner-filtering logic.
4. Send the request: Execute the following HTTP request:

curl -X GET 'http://<target>/studiocms_api/rest/v1/secure/users?rank=owner' \
  -H 'Authorization: Bearer <admin-api-token>'

5. Collect owner account data: Parse the JSON response, which will contain owner account records including id, email, name, username, rank, and timestamps — data that should be inaccessible to admin-rank callers.
6. Chain for further attacks: Use the harvested email addresses and usernames to conduct targeted phishing, credential stuffing, or social engineering against owner accounts (GitHub Advisory).

• Network: HTTP GET requests to /studiocms_api/rest/v1/secure/users with the query parameter rank=owner from admin-authenticated sessions; unusual volume of user enumeration requests to the secure REST API endpoint.
• Logs: API access logs showing requests to the getUsers endpoint with rank=owner parameter from admin tokens, particularly from unexpected IP addresses or at unusual times; repeated enumeration patterns against the /secure/users path.
• Application Behavior: Admin-level API tokens querying user data beyond their expected operational scope; bulk user listing requests that include owner-rank accounts in the response payload (GitHub Advisory).

Upgrade StudioCMS to version 0.4.4 or later, which applies the fix in commit aebe8bc by replacing the attacker-controlled parameter check with a server-side privilege-index comparison (Release Notes). As a temporary workaround prior to patching, apply network-level access controls to restrict which clients can reach the /studiocms_api/rest/v1/secure/users endpoint, and audit existing admin API tokens for unauthorized use. After patching, review API access logs to identify any prior enumeration of owner accounts by admin tokens (GitHub Advisory).