CVE-2026-118574 in S3 File System Plugin
Summary
by MITRE • 10/30/2026
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The S3 File System module for the widely used Drupal content management framework contains a critical security flaw related to incorrect permission assignment on resources that are synchronized with Amazon Simple Storage Service buckets. This vulnerability, identified as allowing exploitation of incorrectly configured access control security levels, stems from how the module handles file uploads and metadata synchronization between the local Drupal instance and remote S3 storage. When files are uploaded or managed through this integration, the module fails to strictly enforce appropriate ownership and permission settings on the underlying resource objects within the cloud environment. This oversight creates a scenario where the default permissions applied to these resources may be overly permissive, potentially granting read or write access to unintended users or services that should not have such privileges according to the principle of least privilege.
From a technical perspective, this flaw represents an instance of CWE-732: Incorrect Permission Assignment for Critical Resource. The vulnerability arises because the module does adequately validate or override the default bucket policies and object ACLs (Access Control Lists) provided by AWS during the upload process. In many cloud configurations, if specific permissions are not explicitly set to deny public access or restrict IAM roles, resources may inherit broader access rights than intended by the site administrator. This is particularly dangerous in environments where sensitive data such as user uploads, private documents, or configuration files are stored via this module. An attacker who gains knowledge of the object paths within the S3 bucket could potentially exploit these loose permissions to read confidential information or, if write permissions are also exposed, modify or delete critical assets without authentication against the Drupal application itself.
The operational impact of this vulnerability is significant for organizations relying on Drupal and AWS infrastructure for data storage. It effectively bypasses the application-level security controls that Drupal provides through its user role system. Even if a user does not have permission to view a file within the Drupal interface, they might still be able to access it directly via the S3 URL if the bucket permissions are misconfigured due to this module's behavior. This leads to unauthorized data disclosure and potential integrity violations. Furthermore, in multi-tenant or shared hosting environments where multiple sites share an AWS account, improper permission handling could allow cross-site contamination, compromising the isolation between different Drupal installations stored within the same S3 infrastructure.
This vulnerability aligns with ATT&CK technique T1078: Valid Accounts and potentially T1530: Data from Cloud Storage if exploited for exfiltration. The root cause is not a failure in authentication but rather a failure in authorization at the storage layer, highlighting the importance of securing cloud resources independently of application logic. To mitigate this risk, administrators must immediately upgrade to S3 File System version 3.12.1 or later, where these permission assignments have been corrected to ensure strict adherence to intended security policies. Additionally, it is crucial for site maintainers to audit their existing S3 bucket configurations and object ACLs to identify any resources that may have already been exposed with overly permissive settings during the window of vulnerability. Implementing server-side encryption and enforcing bucket-level block public access settings can further reduce the attack surface by ensuring that even if permission assignments are flawed, direct external access remains restricted unless explicitly authorized through secure IAM roles rather than open ACLs.