CVE-2026-24134

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-24134

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24134.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-24134

Aliases

GHSA-8cw6-53m5-4932

Published

2026-01-27T23:34:55Z

Modified

2026-10-21T02:30:25Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

StudioCMS has an Authorization Bypass Through User-Controlled Key

Details

StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/Owner users. Version 0.2.0 patches the issue.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-639",
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24134.json"
}

References

Affected packages

Git / github.com/withstudiocms/studiocms

Affected ranges

Type

GIT

Repo

https://github.com/withstudiocms/studiocms

Events

Introduced

Fixed

27e300bbb7b37c3440499a177cab3e38e9dd4bd5

Fixed

efc10bee20db090fdd75463622c30dda390c50ad

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:studiocms:studiocms:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.2.0"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "efc10bee20db090fdd75463622c30dda390c50ad"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "studiocms@0.2.0",
            "range":  [
                {
                    "fixed":  "27e300bbb7b37c3440499a177cab3e38e9dd4bd5"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.1.0-beta.1

@astrolicious/studiocms-blog@0.*

@astrolicious/studiocms-blog@0.1.0-beta.2

@astrolicious/studiocms-blog@0.1.0-beta.3

@astrolicious/studiocms-blog@0.1.0-beta.4

@astrolicious/studiocms@0.*

@astrolicious/studiocms@0.1.0-beta.2

@astrolicious/studiocms@0.1.0-beta.3

@astrolicious/studiocms@0.1.0-beta.4

@studiocms/assets@0.*

@studiocms/assets@0.1.0-beta.5

@studiocms/assets@0.1.0-beta.6

@studiocms/assets@0.1.0-beta.7

@studiocms/auth0@0.*

@studiocms/auth0@0.1.0

@studiocms/auth0@0.1.0-beta.23

@studiocms/auth0@0.1.0-beta.24

@studiocms/auth0@0.1.0-beta.25

@studiocms/auth0@0.1.0-beta.26

@studiocms/auth0@0.1.0-beta.27

@studiocms/auth0@0.1.0-beta.28

@studiocms/auth0@0.1.0-beta.29

@studiocms/auth0@0.1.0-beta.30

@studiocms/auth0@0.1.0-beta.31

@studiocms/auth0@0.1.1

@studiocms/auth@0.*

@studiocms/auth@0.1.0-beta.5

@studiocms/auth@0.1.0-beta.6

@studiocms/auth@0.1.0-beta.7

@studiocms/betaresources@0.*

@studiocms/betaresources@0.1.0-beta.5

@studiocms/betaresources@0.1.0-beta.6

@studiocms/betaresources@0.1.0-beta.7

@studiocms/blog@0.*

@studiocms/blog@0.1.0

@studiocms/blog@0.1.0-beta.10

@studiocms/blog@0.1.0-beta.11

@studiocms/blog@0.1.0-beta.12

@studiocms/blog@0.1.0-beta.13

@studiocms/blog@0.1.0-beta.14

@studiocms/blog@0.1.0-beta.15

@studiocms/blog@0.1.0-beta.16

@studiocms/blog@0.1.0-beta.17

@studiocms/blog@0.1.0-beta.18

@studiocms/blog@0.1.0-beta.19

@studiocms/blog@0.1.0-beta.20

@studiocms/blog@0.1.0-beta.21

@studiocms/blog@0.1.0-beta.22

@studiocms/blog@0.1.0-beta.23

@studiocms/blog@0.1.0-beta.24

@studiocms/blog@0.1.0-beta.25

@studiocms/blog@0.1.0-beta.26

@studiocms/blog@0.1.0-beta.27

@studiocms/blog@0.1.0-beta.28

@studiocms/blog@0.1.0-beta.29

@studiocms/blog@0.1.0-beta.30

@studiocms/blog@0.1.0-beta.31

@studiocms/blog@0.1.0-beta.5

@studiocms/blog@0.1.0-beta.6

@studiocms/blog@0.1.0-beta.7

@studiocms/blog@0.1.0-beta.8

@studiocms/blog@0.1.0-beta.9

@studiocms/blog@0.1.1

@studiocms/cloudinary-image-service@0.*

@studiocms/cloudinary-image-service@0.1.0

@studiocms/cloudinary-image-service@0.1.0-beta.19

@studiocms/cloudinary-image-service@0.1.0-beta.20

@studiocms/cloudinary-image-service@0.1.0-beta.21

@studiocms/cloudinary-image-service@0.1.0-beta.22

@studiocms/cloudinary-image-service@0.1.0-beta.23

@studiocms/cloudinary-image-service@0.1.0-beta.24

@studiocms/cloudinary-image-service@0.1.0-beta.25

@studiocms/cloudinary-image-service@0.1.0-beta.26

@studiocms/cloudinary-image-service@0.1.0-beta.27

@studiocms/cloudinary-image-service@0.1.0-beta.28

@studiocms/cloudinary-image-service@0.1.0-beta.29

@studiocms/cloudinary-image-service@0.1.0-beta.30

@studiocms/cloudinary-image-service@0.1.0-beta.31

@studiocms/cloudinary-image-service@0.1.1

@studiocms/core@0.*

@studiocms/core@0.1.0-beta.5

@studiocms/core@0.1.0-beta.6

@studiocms/core@0.1.0-beta.7

@studiocms/dashboard@0.*

@studiocms/dashboard@0.1.0-beta.5

@studiocms/dashboard@0.1.0-beta.6

@studiocms/dashboard@0.1.0-beta.7

@studiocms/devapps@0.*

@studiocms/devapps@0.1.0

@studiocms/devapps@0.1.0-beta.10

@studiocms/devapps@0.1.0-beta.11

@studiocms/devapps@0.1.0-beta.12

@studiocms/devapps@0.1.0-beta.13

@studiocms/devapps@0.1.0-beta.14

@studiocms/devapps@0.1.0-beta.15

@studiocms/devapps@0.1.0-beta.16

@studiocms/devapps@0.1.0-beta.17

@studiocms/devapps@0.1.0-beta.18

@studiocms/devapps@0.1.0-beta.19

@studiocms/devapps@0.1.0-beta.20

@studiocms/devapps@0.1.0-beta.21

@studiocms/devapps@0.1.0-beta.22

@studiocms/devapps@0.1.0-beta.23

@studiocms/devapps@0.1.0-beta.24

@studiocms/devapps@0.1.0-beta.25

@studiocms/devapps@0.1.0-beta.26

@studiocms/devapps@0.1.0-beta.27

@studiocms/devapps@0.1.0-beta.28

@studiocms/devapps@0.1.0-beta.29

@studiocms/devapps@0.1.0-beta.30

@studiocms/devapps@0.1.0-beta.31

@studiocms/devapps@0.1.0-beta.8

@studiocms/devapps@0.1.0-beta.9

@studiocms/devapps@0.1.1

@studiocms/discord@0.*

@studiocms/discord@0.1.0

@studiocms/discord@0.1.0-beta.23

@studiocms/discord@0.1.0-beta.24

@studiocms/discord@0.1.0-beta.25

@studiocms/discord@0.1.0-beta.26

@studiocms/discord@0.1.0-beta.27

@studiocms/discord@0.1.0-beta.28

@studiocms/discord@0.1.0-beta.29

@studiocms/discord@0.1.0-beta.30

@studiocms/discord@0.1.0-beta.31

@studiocms/discord@0.1.1

@studiocms/frontend@0.*

@studiocms/frontend@0.1.0-beta.5

@studiocms/frontend@0.1.0-beta.6

@studiocms/frontend@0.1.0-beta.7

@studiocms/github@0.*

@studiocms/github@0.1.0

@studiocms/github@0.1.0-beta.23

@studiocms/github@0.1.0-beta.24

@studiocms/github@0.1.0-beta.25

@studiocms/github@0.1.0-beta.26

@studiocms/github@0.1.0-beta.27

@studiocms/github@0.1.0-beta.28

@studiocms/github@0.1.0-beta.29

@studiocms/github@0.1.0-beta.30

@studiocms/github@0.1.0-beta.31

@studiocms/github@0.1.1

@studiocms/google@0.*

@studiocms/google@0.1.0

@studiocms/google@0.1.0-beta.23

@studiocms/google@0.1.0-beta.24

@studiocms/google@0.1.0-beta.25

@studiocms/google@0.1.0-beta.26

@studiocms/google@0.1.0-beta.27

@studiocms/google@0.1.0-beta.28

@studiocms/google@0.1.0-beta.29

@studiocms/google@0.1.0-beta.30

@studiocms/google@0.1.0-beta.31

@studiocms/google@0.1.1

@studiocms/html@0.*

@studiocms/html@0.1.0

@studiocms/html@0.1.0-beta.22

@studiocms/html@0.1.0-beta.23

@studiocms/html@0.1.0-beta.24

@studiocms/html@0.1.0-beta.25

@studiocms/html@0.1.0-beta.26

@studiocms/html@0.1.0-beta.27

@studiocms/html@0.1.0-beta.28

@studiocms/html@0.1.0-beta.29

@studiocms/html@0.1.0-beta.30

@studiocms/html@0.1.0-beta.31

@studiocms/html@0.1.1

@studiocms/imagehandler@0.*

@studiocms/imagehandler@0.1.0-beta.5

@studiocms/imagehandler@0.1.0-beta.6

@studiocms/imagehandler@0.1.0-beta.7

@studiocms/markdoc@0.*

@studiocms/markdoc@0.1.0

@studiocms/markdoc@0.1.0-beta.13

@studiocms/markdoc@0.1.0-beta.14

@studiocms/markdoc@0.1.0-beta.15

@studiocms/markdoc@0.1.0-beta.16

@studiocms/markdoc@0.1.0-beta.17

@studiocms/markdoc@0.1.0-beta.18

@studiocms/markdoc@0.1.0-beta.19

@studiocms/markdoc@0.1.0-beta.20

@studiocms/markdoc@0.1.0-beta.21

@studiocms/markdoc@0.1.0-beta.22

@studiocms/markdoc@0.1.0-beta.23

@studiocms/markdoc@0.1.0-beta.24

@studiocms/markdoc@0.1.0-beta.25

@studiocms/markdoc@0.1.0-beta.26

@studiocms/markdoc@0.1.0-beta.27

@studiocms/markdoc@0.1.0-beta.28

@studiocms/markdoc@0.1.0-beta.29

@studiocms/markdoc@0.1.0-beta.30

@studiocms/markdoc@0.1.0-beta.31

@studiocms/markdoc@0.1.1

@studiocms/md@0.*

@studiocms/md@0.1.0

@studiocms/md@0.1.0-beta.22

@studiocms/md@0.1.0-beta.23

@studiocms/md@0.1.0-beta.24

@studiocms/md@0.1.0-beta.25

@studiocms/md@0.1.0-beta.26

@studiocms/md@0.1.0-beta.27

@studiocms/md@0.1.0-beta.28

@studiocms/md@0.1.0-beta.29

@studiocms/md@0.1.0-beta.30

@studiocms/md@0.1.0-beta.31

@studiocms/md@0.1.1

@studiocms/mdx@0.*

@studiocms/mdx@0.1.0

@studiocms/mdx@0.1.0-beta.13

@studiocms/mdx@0.1.0-beta.14

@studiocms/mdx@0.1.0-beta.15

@studiocms/mdx@0.1.0-beta.16

@studiocms/mdx@0.1.0-beta.17

@studiocms/mdx@0.1.0-beta.18

@studiocms/mdx@0.1.0-beta.19

@studiocms/mdx@0.1.0-beta.20

@studiocms/mdx@0.1.0-beta.21

@studiocms/mdx@0.1.0-beta.22

@studiocms/mdx@0.1.0-beta.23

@studiocms/mdx@0.1.0-beta.24

@studiocms/mdx@0.1.0-beta.25

@studiocms/mdx@0.1.0-beta.26

@studiocms/mdx@0.1.0-beta.27

@studiocms/mdx@0.1.0-beta.28

@studiocms/mdx@0.1.0-beta.29

@studiocms/mdx@0.1.0-beta.30

@studiocms/mdx@0.1.0-beta.31

@studiocms/mdx@0.1.1

@studiocms/migrator@0.*

@studiocms/migrator@0.1.0

@studiocms/migrator@0.1.0-beta.1

@studiocms/migrator@0.1.1

@studiocms/renderers@0.*

@studiocms/renderers@0.1.0-beta.5

@studiocms/renderers@0.1.0-beta.6

@studiocms/renderers@0.1.0-beta.7

@studiocms/robotstxt@0.*

@studiocms/robotstxt@0.1.0-beta.5

@studiocms/robotstxt@0.1.0-beta.6

@studiocms/robotstxt@0.1.0-beta.7

@studiocms/s3-storage@0.*

@studiocms/s3-storage@0.1.0

@studiocms/s3-storage@0.1.1

@studiocms/wysiwyg@0.*

@studiocms/wysiwyg@0.1.0

@studiocms/wysiwyg@0.1.0-beta.24

@studiocms/wysiwyg@0.1.0-beta.25

@studiocms/wysiwyg@0.1.0-beta.26

@studiocms/wysiwyg@0.1.0-beta.27

@studiocms/wysiwyg@0.1.0-beta.28

@studiocms/wysiwyg@0.1.0-beta.29

@studiocms/wysiwyg@0.1.0-beta.30

@studiocms/wysiwyg@0.1.0-beta.31

@studiocms/wysiwyg@0.1.1

@withstudiocms/auth-kit@0.*

@withstudiocms/auth-kit@0.1.0

@withstudiocms/auth-kit@0.1.0-beta.1

@withstudiocms/auth-kit@0.1.0-beta.2

@withstudiocms/auth-kit@0.1.0-beta.3

@withstudiocms/auth-kit@0.1.0-beta.4

@withstudiocms/auth-kit@0.1.0-beta.5

@withstudiocms/auth-kit@0.1.0-beta.6

@withstudiocms/auth-kit@0.1.1

@withstudiocms/buildkit@0.*

@withstudiocms/buildkit@0.1.0

@withstudiocms/buildkit@0.1.0-beta.1

@withstudiocms/buildkit@0.1.0-beta.2

@withstudiocms/buildkit@0.1.0-beta.3

@withstudiocms/buildkit@0.1.0-beta.4

@withstudiocms/buildkit@0.1.0-beta.5

@withstudiocms/buildkit@0.1.0-beta.6

@withstudiocms/component-registry@0.*

@withstudiocms/component-registry@0.1.0

@withstudiocms/component-registry@0.1.0-beta.1

@withstudiocms/component-registry@0.1.0-beta.2

@withstudiocms/component-registry@0.1.0-beta.3

@withstudiocms/component-registry@0.1.0-beta.4

@withstudiocms/component-registry@0.1.0-beta.5

@withstudiocms/component-registry@0.1.0-beta.6

@withstudiocms/component-registry@0.1.0-beta.7

@withstudiocms/component-registry@0.1.1

@withstudiocms/config-utils@0.*

@withstudiocms/config-utils@0.1.0

@withstudiocms/config-utils@0.1.0-beta.1

@withstudiocms/config-utils@0.1.0-beta.2

@withstudiocms/config-utils@0.1.0-beta.3

@withstudiocms/config-utils@0.1.0-beta.4

@withstudiocms/config-utils@0.1.0-beta.5

@withstudiocms/effect@0.*

@withstudiocms/effect@0.1.0

@withstudiocms/effect@0.1.0-beta.1

@withstudiocms/effect@0.1.0-beta.2

@withstudiocms/effect@0.1.0-beta.3

@withstudiocms/effect@0.1.0-beta.4

@withstudiocms/effect@0.1.0-beta.5

@withstudiocms/effect@0.1.0-beta.6

@withstudiocms/effect@0.1.0-beta.7

@withstudiocms/internal_helpers@0.*

@withstudiocms/internal_helpers@0.1.0

@withstudiocms/internal_helpers@0.1.0-beta.1

@withstudiocms/internal_helpers@0.1.0-beta.2

@withstudiocms/internal_helpers@0.1.0-beta.3

@withstudiocms/internal_helpers@0.1.0-beta.4

@withstudiocms/kysely@0.*

@withstudiocms/kysely@0.1.0

@withstudiocms/kysely@0.1.0-beta.1

@withstudiocms/sdk@0.*

@withstudiocms/sdk@0.1.0

@withstudiocms/sdk@0.1.0-beta.1

@withstudiocms/sdk@0.1.1

@withstudiocms/template-lang@0.*

@withstudiocms/template-lang@0.1.0

@withstudiocms/template-lang@0.1.0-beta.1

studiocms@0.*

studiocms@0.1.0

studiocms@0.1.0-beta.10

studiocms@0.1.0-beta.11

studiocms@0.1.0-beta.12

studiocms@0.1.0-beta.13

studiocms@0.1.0-beta.14

studiocms@0.1.0-beta.15

studiocms@0.1.0-beta.16

studiocms@0.1.0-beta.17

studiocms@0.1.0-beta.18

studiocms@0.1.0-beta.19

studiocms@0.1.0-beta.20

studiocms@0.1.0-beta.21

studiocms@0.1.0-beta.22

studiocms@0.1.0-beta.23

studiocms@0.1.0-beta.24

studiocms@0.1.0-beta.25

studiocms@0.1.0-beta.26

studiocms@0.1.0-beta.27

studiocms@0.1.0-beta.28

studiocms@0.1.0-beta.29

studiocms@0.1.0-beta.30

studiocms@0.1.0-beta.31

studiocms@0.1.0-beta.5

studiocms@0.1.0-beta.6

studiocms@0.1.0-beta.7

studiocms@0.1.0-beta.8

studiocms@0.1.0-beta.9

studiocms@0.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24134.json"