7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32101

CVE-2026-32101: StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared async (returns Promise<boolean>) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check. Any authenticated user with the lowest visitor role can upload, delete, rename, and list all files in the S3 bucket. This vulnerability is fixed in 0.3.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32101

CVE-2026-32101:

7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@studiocms/s3-storage	npm	<= 0.3.0	0.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the s3-storage-manager.ts file within the S3ApiService class. Both the getPOST and getPUT methods, which handle storage operations like listing, deleting, and uploading files, perform an authorization check using an isAuthorized function. This function is asynchronous, returning a Promise<boolean>. The vulnerability was introduced because the calls to isAuthorized were not awaited. In JavaScript, a Promise object is always truthy, so the negation !isAuthorized(...) always resulted in false, causing the authorization check to be completely bypassed. As a result, any user who is authenticated, even with the lowest privileges (e.g., 'visitor'), could perform administrative actions on the S3 storage bucket. The fix was to add the await keyword to the isAuthorized calls in both the getPOST and getPUT method handlers, ensuring that the code waits for the promise to resolve to a boolean value before evaluating the authorization status.

Vulnerable functions

S3ApiService.getPOST

packages/@studiocms/s3-storage/src/s3-storage-manager.ts

The `getPOST` method returns an async handler function that performs authorization checks for actions like 'list' and 'delete'. The `isAuthorized` function it calls is asynchronous and returns a Promise. The original code failed to `await` the result of this function. In JavaScript, a pending Promise is a 'truthy' object, so `!isAuthorized()` always evaluates to `false`. This effectively bypasses the authorization check, allowing any authenticated user, regardless of their permission level, to execute sensitive storage operations.

S3ApiService.getPUT

packages/@studiocms/s3-storage/src/s3-storage-manager.ts

The `getPUT` method returns an async handler function for file uploads. The `isAuthorized` function it calls is asynchronous and returns a Promise. The original code failed to `await` the result of this function. In JavaScript, a pending Promise is a 'truthy' object, so `!isAuthorized()` always evaluates to `false`. This effectively bypasses the authorization check, allowing any authenticated user, regardless of their permission level, to upload or overwrite files in the S3 bucket.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.