High, CVSS 7.6npmAmendedPublished
StudioCMS S3 Storage Manager Authorization Bypass via Missing await on Async Auth Check
CVE-2026-32101 · GHSA-mm78-fgq8-6pgr
- Affected
- npm @studiocms/s3-storage <= 0.3.0
- Fixed in
- 0.3.1· Vendor fix available
- Issue
- The S3 storage manager's isAuthorized() function is declared async (returns Promise<boolean) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check. Any authenticated user with the lowest visitor role can upload, delete, rename, and list all files in the S3 bucket. Details The isAuthorized function is typed as returning Promise<boolean in packages/studiocms/src/handlers/storage-manager/definitions.ts:88: Both context drivers implement it as async — packages/studiocms/src/handlers/storage-manager/core/effectify-astro-context.ts:32: But in the S3 storage manager, it's called without await — packages/@studiocms/s3-storage/src/s3-storage-manager.ts:200: And again at line 372 (PUT handler): isAuthorized(type) returns a Promise object. !Promise{...} is always false because a Promise is truthy. The 401 response is never returned.…
Recommended action: Upgrade to 0.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.