CVE-2026-32638
1 advisory.
npm/studiocms CVE-2026-32638: low 2.7, EPSS 0.39%
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
Action: Upgrade studiocms to 0.4.4 or later.
npm i studiocms@0.4.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.4.4 | - |
Fixed versions
| 0.4.4 |
Sources
- osv: GHSA-xvf4-ch4q-2m24
- https://github.com/withstudiocms/studiocms/security/advisories/GHSA-xvf4-ch4q-2m24
- https://nvd.nist.gov/vuln/detail/CVE-2026-32638
- https://github.com/withstudiocms/studiocms/commit/aebe8bcb3618bb07c6753e3f5c982c1fe6adea64
- https://github.com/withstudiocms/studiocms
- https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.4
CVE-2026-32638 · published · modified · JSON