npm/studiocms CVE-2026-30944: high 8.8, EPSS 0.57%

StudioCMS has Privilege Escalation via Insecure API Token Generation

Action: Upgrade studiocms to 0.4.0 or later.

npm i studiocms@0.4.0

Affected

Fixed versions

Sources

• osv: GHSA-667w-mmh7-mrr4
• https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4
• https://nvd.nist.gov/vuln/detail/CVE-2026-30944
• https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3
• https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441
• https://github.com/withstudiocms/studiocms
• https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.4.0
• https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0

CVE-2026-30944 · published 2026-03-10T18:16:41Z · modified 2026-03-10T19:01:27.416110Z · JSON