StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts

Summary

The REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts via the REST API, enabling privilege proliferation and persistence.

Details

The REST API handler in packages/studiocms/frontend/pages/studiocms_api/_handlers/rest-api/v1/secure.ts:1365-1378:

// REST API — only blocks creating 'owner'
if (newUserRank === 'owner' && rank !== 'owner') {
    return yield* new RestAPIError({
        error: 'Unauthorized to create user with owner rank',
    });
}

if (rank === 'admin' && newUserRank === 'owner') {
    return yield* new RestAPIError({
        error: 'Unauthorized to create user with owner rank',
    });
}

// Missing: no check preventing admin from creating admin
// newUserRank='admin' passes all checks

The Dashboard API handler in _handlers/dashboard/create.ts uses the correct approach:

// Dashboard API — blocks creating users at or above own rank
const callerPerm = availablePermissionRanks.indexOf(userData.permissionLevel);
const targetPerm = availablePermissionRanks.indexOf(rank);

if (targetPerm >= callerPerm) {
    return yield* new DashboardAPIError({
        error: 'Unauthorized: insufficient permissions to assign target rank',
    });
}

With availablePermissionRanks = ['unknown', 'visitor', 'editor', 'admin', 'owner']:

• Admin (index 3) creating admin (index 3): 3 >= 3 = blocked in Dashboard
• In REST API: no such check — allowed

PoC

# 1. Use an admin-level API token

# 2. Create a new admin user via REST API
curl -X POST 'http://localhost:4321/studiocms_api/rest/v1/secure/users' \
  -H 'Authorization: Bearer <admin-api-token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "rogue_admin",
    "email": "[email protected]",
    "displayname": "Rogue Admin",
    "rank": "admin",
    "password": "StrongP@ssw0rd123"
  }'

# Expected: 403 Forbidden (admin should not create peer admin accounts)
# Actual: 200 with new admin user created

Impact

• A compromised or rogue admin can create additional admin accounts as persistence mechanisms that survive password resets or token revocations
• Inconsistent security model between Dashboard API and REST API creates confusion about intended authorization boundaries
• Note: requires admin access (PR:H), which limits practical severity