StudioCMS allows any authenticated user with editor privileges or higher to delete API tokens of any account by sending a DELETE request to /studiocms_api/dashboard/api-tokens. The request payload accepts a tokenID and userID without validating that the token belongs to the caller or that the caller has authority over that account. This unauthorized removal of tokens can prevent automated tools, third‑party services, or scheduled jobs from authenticating, effectively causing a denial of service to those integrations. The weakness is an IDOR, classified as CWE‑639 and CWE‑863.

The vulnerability exists in StudioCMS releases before 0.4.0. The affected product is StudioCMS, as identified by the vendor withstudiocms and the product studiocms. All installations that have not applied the 0.4.0 patch or later are susceptible, regardless of the host environment.

The CVSS score of 7.1 reflects moderate to high severity. The EPSS score is below 1%, indicating very low probability that this vulnerability is exploited in the wild. The vulnerability is not currently listed in the CISA KEV catalog. An attacker needs to be authenticated with at least editor role, so the attack is not purely remote and requires legitimate credentials. Still, the ease of revoking tokens and the potential disruption to business-critical integrations make it a significant risk if not mitigated.