CVE Explorer

CVE-2026-32103

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller's identity. Combined with the POST /studiocms_api/d

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:ad40f993a011bfc1682da6a1f12b01d855d81f1eb88bb9de77941f6c55fb149d

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-639","description":"CWE-639: Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:84917d4dcbaca2e3dfe248a56f8bacecb01d20e1e750e9519bde1df4e32318ea · sha256:3cc7a8aedeee5956… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-640","description":"CWE-640: Weak Password Recovery Mechanism for Forgotten Password","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:84917d4dcbaca2e3dfe248a56f8bacecb01d20e1e750e9519bde1df4e32318ea · sha256:3cc7a8aedeee5956… · /containers/cna/problemTypes/1/descriptions/0

Affected products and versions

1 source assertion

{"product":"studiocms","vendor":"withstudiocms","versions":[{"status":"affected","version":"< 0.4.3"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:84917d4dcbaca2e3dfe248a56f8bacecb01d20e1e750e9519bde1df4e32318ea · sha256:3cc7a8aedeee5956… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:84917d4dcbaca2e3dfe248a56f8bacecb01d20e1e750e9519bde1df4e32318ea · sha256:3cc7a8aedeee5956… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions

{"cweId":"CWE-639","description":"CWE-639: Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:84917d4dcbaca2e3dfe248a56f8bacecb01d20e1e750e9519bde1df4e32318ea · sha256:3cc7a8aedeee5956… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-640","description":"CWE-640: Weak Password Recovery Mechanism for Forgotten Password","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:84917d4dcbaca2e3dfe248a56f8bacecb01d20e1e750e9519bde1df4e32318ea · sha256:3cc7a8aedeee5956… · /containers/cna/problemTypes/1/descriptions/0

Source references

1 source assertion

{"name":"https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c","tags":["x_refsource_CONFIRM"],"url":"https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:84917d4dcbaca2e3dfe248a56f8bacecb01d20e1e750e9519bde1df4e32318ea · sha256:3cc7a8aedeee5956… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer