StudioCMS’s S3 storage manager mistakenly treats an async authorization check as synchronous because the call to isAuthorized() is not awaited in both POST and PUT request handlers. Since a Promise object in JavaScript is always truthy, the negated check '!isAuthorized(type)' always evaluates to false, completely bypassing the intended permission guard. This flaw allows any authenticated user with the lowest visitor role to upload, delete, rename, and list all files in the configured S3 bucket, resulting in a loss of integrity and control over stored assets.

Any deployment of StudioCMS using the @studiocms:s3-storage component and running a version earlier than 0.3.1 is vulnerable. Versions up to, but not including, 0.3.1 share the same faulty implementation of isAuthorized().

The vulnerability has a CVSS score of 7.6, indicating high severity. Its EPSS score is below 1 %, suggesting current exploitation attempts are rare. The flaw is not listed in the CISA KEV catalog. An attacker requires authentication to the CMS and must use the web application's POST or PUT endpoints to trigger the bypass. Based on the description, the likely attack vector is remote, web‑based actions performed by any authenticated visitor‑role user. The missing await makes exploitation trivial for authorized users.