Is CVE-2026-32104 actively exploited?

No active exploitation of CVE-2026-32104 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32104 be exploited remotely?

Yes. CVE-2026-32104 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32104?

CVE-2026-32104 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2026-32104

MEDIUM

CVE-2026-32104

CWE-639Published: March 11, 2026· Updated: Mar 17, 2026

5.4

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:10.1th

Official Description

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity. This vulnerability is fixed in 0.4.3.

NVD Source

Technical Analysis

CVE-2026-32104 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.