StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check

Description

The S3 storage manager’s isAuthorized() function is declared async (returns Promise<boolean>) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check.

Recommendation

Update the @studiocms/s3-storage package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.3.0
• Patched version(s): 0.3.1

References

• GHSA-mm78-fgq8-6pgr
• CVE-2026-32101
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass - paperclipai - CVE-2026-41679
• LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header - CVE-2026-39411
• Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries - CVE-2026-32728
• Parse Server has an auth provider validation bypass on login via partial authData - CVE-2026-33409

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@studiocms/s3-storage