StudioCMS REST API getUsers endpoint allowed an authenticated admin to retrieve owner account information, including IDs, usernames, display names, and email addresses, by setting the rank query parameter to owner. This exposure of sensitive user data constitutes an authorization inconsistency and leads to an information disclosure vulnerability. The weakness is identified as CWE-639, indicating untrusted input can be used to discover account information.

The affected package is withstudiocms:studiocms. All installations running a version older than 0.4.4 are vulnerable. Version 0.4.4 and later remove the flaw by correctly filtering owner records for admin tokens.

The CVSS score of 2.7 indicates low to moderate severity, and the EPSS score of less than 1% signals a very low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires possession of a valid admin token, which is likely already granted to authorized administrators. An attacker could simply send a GET request to the getUsers endpoint with rank=owner to harvest owner account data.