https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32638.htmlhttps://patchthecve.com/cve/CVE-2026-32638.htmlWed, 17 Jun 2026 10:36:08 +0000LOW 2.7: StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the attacker-controlled `rank` query parameter to decide whether owner accounts should be filtered from the result set. As a result, an admin tokehttps://patchthecve.com/cve/CVE-2026-30945.htmlhttps://patchthecve.com/cve/CVE-2026-30945.htmlWed, 17 Jun 2026 10:33:12 +0000HIGH 7.1: StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner acchttps://patchthecve.com/cve/CVE-2026-30944.htmlhttps://patchthecve.com/cve/CVE-2026-30944.htmlWed, 17 Jun 2026 10:33:11 +0000HIGH 8.8: StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails tohttps://patchthecve.com/cve/CVE-2026-24134.htmlhttps://patchthecve.com/cve/CVE-2026-24134.htmlWed, 17 Jun 2026 10:22:41 +0000MEDIUM 6.5: StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/