CVE-2026-32101: StudioCMS S3 Storage Manager authorization bypass via missing await

CVE-2026-32101 · Severity: low · CVSS 3.1 · Published 2026-03-12

StudioCMS's S3 Storage Manager handles file operations (upload, delete, list, rename) for cloud storage integration. A developer error—calling an async authorization check without await—causes the security check to always pass. Any authenticated user with basic "visitor" permissions can perform privileged file operations (upload, delete, list all files) that should be restricted to editors, enabling data theft, corruption, or loss.

Vendors: npm, StudioCMS.

Quick answers

Is CVE-2026-32101 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32101 being exploited in the wild.
How severe is CVE-2026-32101?
Low severity, with a CVSS score of 3.1, published 12 March 2026.
Which products and versions are affected?
@studiocms/s3-storage (npm) SEMVER:introduced=0,fixed=0.3.1; StudioCMS S3 Storage Manager <= 0.3.0.
Is there a fix for CVE-2026-32101?
Yes. @studiocms/s3-storage (npm): upgrade to 0.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32101 attacked?
It is attacked over the network.
Am I affected by CVE-2026-32101?
Check whether you run @studiocms/s3-storage (npm) or StudioCMS S3 Storage Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @studiocms/s3-storage (npm): upgrade to 0.3.1 or later
    npm install @studiocms/s3-storage@0.3.1

Technical details

The vulnerability is an authorization bypass (CWE-863) caused by a missing await on an async function call. The isAuthorized() function returns Promise&lt;boolean&gt;, but in both POST and PUT handlers at lines 200 and 372, it is called without await. In JavaScript, a Promise object is always truthy; therefore !isAuthorized(type) always evaluates to false, skipping the 401 Unauthorized response entirely. The vulnerability is reachable over the network to any authenticated user with a valid session cookie. An attacker can upload malicious files, delete legitimate content, enumerate all stored files, and generate presigned URLs to expose sensitive data. The fix is trivial: add await before both isAuthorized() calls. A patch was released in version 0.3.1.

Affected products

  • StudioCMS S3 Storage Manager <= 0.3.0

Identifiers

  • CVE-2026-32101
  • GHSA-mm78-fgq8-6pgr

Timeline

  • 2026-03-11: disclosed
  • 2026-03-12: patched: Fixed in version 0.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.