Studiocms
CVE-2026-32101
HIGH
GHSA-mm78-fgq8-6pgr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege visitor
-
DeliverySend POST/PUT request to file handler
-
ExploitPromise evaluated as truthy
-
ExecutionAuthorization check bypassed
-
ImpactUpload/delete/rename S3 files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | StudioCMS versions before 0.3.1 with S3 storage manager enabled. Attacker requires valid visitor-role credentials (lowest privilege level). Remote unauthenticated exploitation not possible; authentication bypass applies only to authorization logic after login. |
| Impact | Severity: High (7.6/10.0) Very low exploitation probability (EPSS: 0.00034, 9.6th percentile) Remotely exploitable with low-privilege access — any authenticated user could exploit this |
| Exploit ScenarioDerived | An authenticated attacker with low-level access can exploit this vulnerability remotely to escalate privileges or access unauthorized resources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
High severity vulnerability in StudioCMS. The S3 storage manager's isAuthorized() function is declared async (returns Promise<boolean>) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check. Any authenticated user with the lowest visitor role can upload, delete, rename...
RemediationAI
Security advisories:
- https://github.com/withstudiocms/studiocms/security/advisories/GHSA-mm78-fgq8-6pgr
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vulnerability Type: Incorrect Authorization (CWE-863) CVSS 3.1: 7.6/10.0 — Attack Vector: Network | Complexity: Low | Privileges Required: Low | User Interaction: None Attack Techniques: Authentication Bypass Source: https://github.com/withstudiocms/studiocms Authentication bypass allows attackers to access protected resources without valid credentials.
Know when Studiocms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared async (returns Promise<boolean>) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check. Any authenticated user with the lowest visitor role can upload, delete, rename, and list all files in the S3 bucket. This vulnerability is fixed in 0.3.1.
Executive ViewAI
StudioCMS contains a critical authorization bypass vulnerability that allows any authenticated user, regardless of permission level, to upload, delete, and modify files in cloud storage. This exposes sensitive content, enables malware distribution, and creates compliance violations for any organization using StudioCMS with S3 storage.
Implement WAF rules to block POST/PUT requests to storage endpoints; restrict S3 IAM bucket policies to reject requests from StudioCMS application roles; disable S3 integration entirely and use local file storage with proper OS-level permissions; enable S3 Object Lock to prevent deletion; monitor CloudTrail logs for unauthorized S3 modifications; segment StudioCMS network access to limit authenticated user base.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in StudioCMS Authorization and Access Control
View all 5Privilege escalation in StudioCMS versions prior to 0.4.0 enables authenticated Editor-level users to generate API token
StudioCMS prior to version 0.4.0 allows authenticated editors and above to revoke API tokens belonging to any user, incl
headless content management system. versions up to 0.2.0 is affected by authorization bypass through user-controlled key
Exploit-DB