What is the CVSS score of CVE-2026-32101?

CVE-2026-32101 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Studiocms are affected by CVE-2026-32101?

StudioCMS contains a critical authorization bypass vulnerability that allows any authenticated user, regardless of permission level, to upload, delete, and modify files in cloud storage.. A patch is available.

How to fix or mitigate CVE-2026-32101?

Within 24 hours: Disable S3 file upload functionality or restrict S3 storage access to administrative accounts only. Within 7 days: Audit S3 bucket access logs for unauthorized file operations and document all changes made since deployment. Within 30 days: Monitor vendor for patch release; implement patch immediately upon availability or migrate to alternative CMS if no patch timeline is provided.

Studiocms CVE-2026-32101

HIGH

Incorrect Authorization (CWE-863)

2026-03-11 security-advisories@github.com

GHSA-mm78-fgq8-6pgr

Authentication Bypass Studiocms

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 21:16 nvd

HIGH 7.6

DescriptionGitHub Advisory

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared async (returns Promise<boolean>) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check. Any authenticated user with the lowest visitor role can upload, delete, rename, and list all files in the S3 bucket. This vulnerability is fixed in 0.3.1.

AnalysisAI

High severity vulnerability in StudioCMS. The S3 storage manager's isAuthorized() function is declared async (returns Promise<boolean>) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check. Any authenticated user with the lowest visitor role can upload, delete, rename...

Technical ContextAI

Vulnerability Type: Incorrect Authorization (CWE-863) CVSS 3.1: 7.6/10.0 — Attack Vector: Network | Complexity: Low | Privileges Required: Low | User Interaction: None Attack Techniques: Authentication Bypass Source: https://github.com/withstudiocms/studiocms Authentication bypass allows attackers to access protected resources without valid credentials.