Executive brief
StudioCMS's S3 Storage Manager handles file operations (upload, delete, list, rename) for cloud storage integration. A developer error—calling an async authorization check without await—causes the security check to always pass. Any authenticated user with basic "visitor" permissions can perform privileged file operations (upload, delete, list all files) that should be restricted to editors, enabling data theft, corruption, or loss.
Technical details
The vulnerability is an authorization bypass (CWE-863) caused by a missing await on an async function call. The isAuthorized() function returns Promise<boolean>, but in both POST and PUT handlers at lines 200 and 372, it is called without await. In JavaScript, a Promise object is always truthy; therefore !isAuthorized(type) always evaluates to false, skipping the 401 Unauthorized response entirely. The vulnerability is reachable over the network to any authenticated user with a valid session cookie. An attacker can upload malicious files, delete legitimate content, enumerate all stored files, and generate presigned URLs to expose sensitive data. The fix is trivial: add await before both isAuthorized() calls. A patch was released in version 0.3.1.
Affected products
- StudioCMS S3 Storage Manager <= 0.3.0
Timeline
- 2026-03-11: disclosed
- 2026-03-12: patched: Fixed in version 0.3.1