ZeroDay Findings
Sign inSign up

Findings

CVE-2026-32101

StudioCMS is a server-side-rendered, Astro native, headless content management system.

Published Mar 11, 2026 · updated Jun 17, 2026 · studiocms studiocms

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared async (returns Promise ) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check. Any authenticated user with the lowest visitor role can upload, delete, rename, and list all files in the S3 bucket. This vulnerability is fixed in 0.3.1.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 11, 2026 · NIST NVD

    Detected

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared async (returns Promise ) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check.

  2. Jun 17, 2026 · NIST NVD

    Updated

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared async (returns Promise ) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check.

Affected

  • cpe studiocms/studiocmsversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-32101

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-32101

    StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared async (returns Promise ) but is called without await in both the POST and PUT handlers. Since a Promise obje

    nvd.nist.gov

References