A critical authorization bypass vulnerability in StudioCMS allows authenticated users to escalate privileges by generating API tokens for arbitrary accounts.

The application fails to validate authorization at the /studiocms_api/dashboard/api-tokens endpoint, allowing any authenticated user with at least Editor privileges to generate API tokens on behalf of any other user. This flaw constitutes a full privilege escalation, enabling attackers to impersonate owners or administrative accounts.

Successful exploitation of this vulnerability results in full administrative control over the content management system. Given the CVSS score of 8.8, the potential for unauthorized access to sensitive data, modification of site content, and complete compromise of administrative functions presents a severe risk to organizational operations and data integrity.

Immediate Action: Update the StudioCMS package to version 0.4.0 or later to apply the necessary authorization validation fixes.

Proactive Monitoring: Review API access logs for anomalous token generation requests originating from non-administrative user accounts.

Compensating Controls: Implement strict network-level access controls or a WAF rule to restrict access to the /studiocms_api/ dashboard endpoints to known administrative IP addresses until patching is complete.

Public Exploit Available: Unknown

This vulnerability represents a significant security failure that allows for trivial privilege escalation within the StudioCMS environment. Organizations currently running versions prior to 0.4.0 must prioritize the update to the latest version immediately to prevent unauthorized administrative access and potential system takeover.