{"action":"Upgrade studiocms to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0"}],"component":"studiocms","cve_ids":["CVE-2026-30944"],"ecosystem":"npm","epss":0.00574,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-667w-mmh7-mrr4","id":"tcs_01M5KF5Y77NN1XEY95SW7Z4D8T","modified_at":"2026-03-10T19:01:27.416110Z","published_at":"2026-03-10T18:16:41Z","references":["https://osv.dev/vulnerability/GHSA-667w-mmh7-mrr4","https://github.com/withstudiocms/studiocms/security/advisories/GHSA-667w-mmh7-mrr4","https://nvd.nist.gov/vuln/detail/CVE-2026-30944","https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3","https://github.com/withstudiocms/studiocms/commit/f4a209fc090c90195e2419fff47b48a46eab7441","https://github.com/withstudiocms/studiocms","https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.4.0","https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-667w-mmh7-mrr4","url":"https://osv.dev/vulnerability/GHSA-667w-mmh7-mrr4"}],"summary":"StudioCMS has Privilege Escalation via Insecure API Token Generation"}