https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 00:49:01 +0000 https://cve.radiocsirt.org/vuln/cnvd-2026-18149 cnvd-2026-18149 https://cve.radiocsirt.org/vuln/cnvd-2026-18149 https://cve.radiocsirt.org/vuln/euvd-2026-275867 EUVD-2026-275867 https://cve.radiocsirt.org/vuln/euvd-2026-275867 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32104 <p>StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user&#39;s notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity. This vulnerability is fixed in 0.4.3.</p> <p>StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user&#39;s notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity. This vulnerability is fixed in 0.4.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32104 https://cve.radiocsirt.org/vuln/ghsa-9v82-xrm4-mp52 <p><strong>Affected:</strong> npm: studiocms</p> <p>## Summary</p> <p>The `updateUserNotifications` endpoint accepts a user ID from the request payload and uses it to update that user&#39;s notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (`id !== userData.user.id`). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity.</p> <p>## Details</p> <p>The vulnerable handler is in `packages/studiocms/frontend/pages/studiocms_api/_handlers/dashboard/users.ts:257-311`:</p> <p>```typescript .handle( &#39;updateUserNotifications&#39;, Effect.fn(function* ({ payload: { id, notifications } }) { // ...demo mode checks...</p> <p>const [sdk, userData] = yield* Effect.all([SDKCore, CurrentUser]);</p> <p>// Line 274: Only checks login + visitor level — any authenticated user passes if (!userData.isLoggedIn || !userData.userPermissionLevel.isVisitor) { return yield* new DashboardAPIError({ error: &#39;Unauthorized&#39; }); }</p> <p>// Line 280: Uses &#39;id&#39; from payload — NOT userData.user.id const existingUser = yield* sdk.GET.users.byId(id);</p> <p>// Line 288: Updates target user using attacker-controlled &#39;id&#39; const updatedData = yield* sdk.AUTH.user.update({ userId: id, // ← attacker controls this userData: { id, // ← attacker controls this name: existingUser.name,…</p> <p><strong>Affected:</strong> npm: studiocms</p> <p>## Summary</p> <p>The `updateUserNotifications` endpoint accepts a user ID from the request payload and uses it to update that user&#39;s notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (`id !== userData.user.id`). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity.</p> <p>## Details</p> <p>The vulnerable handler is in `packages/studiocms/frontend/pages/studiocms_api/_handlers/dashboard/users.ts:257-311`:</p> <p>```typescript .handle( &#39;updateUserNotifications&#39;, Effect.fn(function* ({ payload: { id, notifications } }) { // ...demo mode checks...</p> <p>const [sdk, userData] = yield* Effect.all([SDKCore, CurrentUser]);</p> <p>// Line 274: Only checks login + visitor level — any authenticated user passes if (!userData.isLoggedIn || !userData.userPermissionLevel.isVisitor) { return yield* new DashboardAPIError({ error: &#39;Unauthorized&#39; }); }</p> <p>// Line 280: Uses &#39;id&#39; from payload — NOT userData.user.id const existingUser = yield* sdk.GET.users.byId(id);</p> <p>// Line 288: Updates target user using attacker-controlled &#39;id&#39; const updatedData = yield* sdk.AUTH.user.update({ userId: id, // ← attacker controls this userData: { id, // ← attacker controls this name: existingUser.name,…</p> https://cve.radiocsirt.org/vuln/ghsa-9v82-xrm4-mp52