Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-b95n-ckqf-hqc5
Vulnerability ID VCID-b95n-ckqf-hqc5
Aliases CVE-2026-24134
GHSA-8cw6-53m5-4932
Summary StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/Owner users. Version 0.2.0 patches the issue.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-639 Authorization Bypass Through User-Controlled Key
CWE-862 Missing Authorization
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2026-24134
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2026-24134
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2026-24134
epss 0.00051 https://api.first.org/data/v1/epss?cve=CVE-2026-24134
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-8cw6-53m5-4932
cvssv3.1 6.5 https://github.com/withstudiocms/studiocms
generic_textual MODERATE https://github.com/withstudiocms/studiocms
cvssv3.1 6.5 https://github.com/withstudiocms/studiocms/commit/efc10bee20db090fdd75463622c30dda390c50ad
generic_textual MODERATE https://github.com/withstudiocms/studiocms/commit/efc10bee20db090fdd75463622c30dda390c50ad
ssvc Track https://github.com/withstudiocms/studiocms/commit/efc10bee20db090fdd75463622c30dda390c50ad
cvssv3.1 6.5 https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.2.0
generic_textual MODERATE https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.2.0
ssvc Track https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.2.0
cvssv3.1 6.5 https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932
cvssv3.1_qr MODERATE https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932
generic_textual MODERATE https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932
ssvc Track https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2026-24134
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-24134
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-24134
https://github.com/withstudiocms/studiocms
CVE-2026-24134 https://nvd.nist.gov/vuln/detail/CVE-2026-24134
efc10bee20db090fdd75463622c30dda390c50ad https://github.com/withstudiocms/studiocms/commit/efc10bee20db090fdd75463622c30dda390c50ad
GHSA-8cw6-53m5-4932 https://github.com/advisories/GHSA-8cw6-53m5-4932
GHSA-8cw6-53m5-4932 https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932
studiocms%400.2.0 https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.2.0
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/withstudiocms/studiocms
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/withstudiocms/studiocms/commit/efc10bee20db090fdd75463622c30dda390c50ad
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-28T15:08:21Z/ Found at https://github.com/withstudiocms/studiocms/commit/efc10bee20db090fdd75463622c30dda390c50ad
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.2.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-28T15:08:21Z/ Found at https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.2.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-28T15:08:21Z/ Found at https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-24134
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.16402
EPSS Score 0.00051
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:52:41.190545+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/24xxx/CVE-2026-24134.json 38.6.0