Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-30944 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Studiocms Studiocms. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-30944 is a privilege escalation vulnerability in StudioCMS, a server-side-rendered, Astro native, headless content management system, affecting versions prior to 0.4.0. The issue stems from the /studiocms_api/dashboard/api-tokens endpoint, which allows any authenticated user with at least Editor privileges to generate API tokens for any other user, including owner and admin accounts. This flaw arises because the endpoint does not validate whether the requesting user is authorized to create tokens on behalf of the specified target user ID, mapped to CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-863 (Incorrect Authorization).
Attackers require only low-privilege Editor access and can exploit the vulnerability remotely over the network with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8). By sending crafted requests to the endpoint, they can generate valid API tokens for higher-privileged accounts, enabling full compromise of the CMS instance through unauthorized access to administrative functions, data manipulation, and potential further lateral movement.
The vulnerability is fixed in StudioCMS 0.4.0. Mitigation involves upgrading to version 0.4.0 or later. Details are available in the patching commit (https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441), release notes (https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0), and GitHub security advisory (https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10555
Vulnerability Data
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to…
more
validate whether the requesting user is authorized to create tokens on behalf of the target user ID, resulting in a full privilege escalation. This vulnerability is fixed in 0.4.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Enforcing approved authorizations on every access request structurally stops a user-controlled key from reaching another user's data.
Requiring explicit access-control decisions on each request blocks unauthorized key-driven access.
A reference monitor that is always invoked and tamper-proof forces every authorization decision through a verified, correct path.
Least-privilege restrictions limit the scope of data reachable even if a key check is bypassed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.
Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing authorization checks but does not prevent the weakness in production.
Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.
Access control policy directly requires enforcement of authorization rules that prevent unauthorized access via manipulated keys.
Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.
Privileged access rights control restricts what data each user may access, mitigating direct object reference attacks.
Secure development lifecycle includes authorization design but does not itself implement runtime access checks.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248581 OL 8 must require users to provide a password for privilege escalation. prevents CWE-863
- V-252656 The OL 8 operating system must not be configured to bypass password requirements for privilege escalation. prevents CWE-863
RHEL 7 (1 rule)
- V-204430 The Red Hat Enterprise Linux operating system must be configured so that users must re-authenticate for privilege escalation. prevents CWE-863
RHEL 8 (1 rule)
- V-251712 The RHEL 8 operating system must not be configured to bypass password requirements for privilege escalation. prevents CWE-863