CVE-2026-32106

CVE-2026-32106 is a high-severity vulnerability affecting StudioCMS versions prior to 0.4.3, where an inconsistency in the REST API's createUser endpoint allows an authenticated administrator to create additional admin accounts. This flaw enables privilege proliferation and persistence, as the API's rank checks are insufficient compared to the Dashboard API. Rated 7.2 CVSS (High), it can be exploited remotely with low complexity by an attacker with high privileges, leading to significant impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or widespread community discussion regarding this vulnerability.