Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared async (returns Promise<boolean>) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check. Any authenticated user with the lowest visitor role can upload, delete, rename, and list all files in the S3 bucket. This vulnerability is fixed in 0.3.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-11 | 1 | General1 |
| 2026-03-12 | 1 | Disclosure1 |
🔴 StudioCMS, Improper Authorization, #CVE-2026-32101 (High) https://dailycve.com/studiocms-improper-authorization-cve-2026-32101-high/
Post summary
The post announces a new high‑severity improper authorization vulnerability (CVE-2026-32101) in StudioCMS, but provides no further exploitation or remediation details.
CVE-2026-32101 StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared as… https://www.cve.org/CVERecord?id=CVE-2026-32101
Post summary
The statement references CVE-2026-32101 and notes a function declaration change before version 0.3.1, but offers no concrete technical details, patch information, or exploitation evidence.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | studiocms | studiocms | - | - | - |