CVE-2026-32101: StudioCMS S3 Storage Manager Authorization Bypass Due to Async Function Misuse
Summary
CVE-2026-32101: StudioCMS S3 Storage Manager Authorization Bypass via Missing await on Async Auth Check. Affects @studiocms/s3-storage versions < 0.3.1. Fixed in 0.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
StudioCMS is a content management system that provides various features for managing digital content, including an S3 Storage Manager for handling file uploads, deletions, and listings. The S3 Storage Manager is designed to ensure that only authorized users can perform sensitive operations on the storage. However, a critical vulnerability has been identified that allows unauthorized access to these operations.
Vulnerability Detail
The vulnerability arises from the misuse of the async function 'isAuthorized()' within the S3 Storage Manager. This function is supposed to return a Promise that resolves to a boolean indicating whether a user is authorized to perform certain actions. However, it is called without the 'await' keyword in the POST and PUT handlers, causing the authorization check to be bypassed. As a result, any authenticated user with the lowest 'visitor' role can upload, delete, rename, and list all files in the S3 bucket, leading to potential data loss and exposure of sensitive content.
How To Fix
Minimum fixed version
0.3.1
This is the first release that contains the fix.
npm install @studiocms/s3-storage@0.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually implement checks in your application logic to restrict access to sensitive operations based on user roles until the package is updated. However, this is not a long-term solution and should not replace the necessary code fixes.
Conclusion
In summary, CVE-2026-32101 is a critical vulnerability in the StudioCMS S3 Storage Manager that allows unauthorized access to sensitive storage operations. It is essential to update the affected package to the patched version to mitigate this risk and ensure proper authorization checks are in place.
See every vulnerability recorded for @studiocms/s3-storage →
FAQ
CVE-2026-32101 is a vulnerability in the StudioCMS S3 Storage Manager that allows unauthorized users to perform sensitive operations due to a missing 'await' on an async authorization check.
Any authenticated user with the lowest 'visitor' role in StudioCMS is affected, as they can exploit this vulnerability to gain unauthorized access to S3 storage management features.
The potential impacts include unauthorized file uploads, deletions, and listings, leading to data loss and exposure of sensitive content stored in the S3 bucket.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
