CVE-2026-32638

CVE-2026-32638 is an authorization inconsistency vulnerability affecting StudioCMS versions prior to 0.4.4. It allows an authenticated administrator to retrieve sensitive owner account details, including IDs, usernames, and email addresses, via the `getUsers` REST API endpoint, despite similar restrictions on the `getUser` endpoint. Rated with a CVSS score of 2.7 (LOW), this issue requires high privileges (an admin token) for exploitation and primarily impacts confidentiality. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.