CVE-2026-32104

CVE-2026-32104 identifies an Insecure Direct Object Reference (IDOR) vulnerability in StudioCMS versions prior to 0.4.3, where the `updateUserNotifications` endpoint fails to verify user ownership. This flaw allows any authenticated user to modify the notification preferences of any other user, including administrators. Rated as Medium severity (CVSS 5.4), it has a low attack complexity and requires only low privileges, as an authenticated attacker can exploit it over the network. The potential impact involves low integrity and availability, as an attacker could disable critical notifications for other users, potentially suppressing alerts about malicious activity. Currently, there is no evidence of active exploitation, and no public exploit code or significant community attention has been observed.