CVE-2026-105867

Summary

Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection's access controls and prior file validation. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Affected Software

VendorProductVersion RangeStatus
payloadcmspayload< 3.90.0affected
payloadcmspayload>= 4.0.0-canary.0, < 4.0.0-canary.34affected
@payloadcmsstorage-s3< 3.90.0affected
@payloadcmsstorage-s3>= 4.0.0-canary.0, < 4.0.0-canary.34affected

Weaknesses

  • CWE-639: CWE-639: Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References