CVE-2026-105867: CWE-639: Authorization Bypass Through User-Controlled Key in payloadcms payload

CVE-2026-105867 is an authorization bypass vulnerability in the PayloadCMS storage-s3 module. It affects versions prior to 3.90.0 and canary versions from 4.0.0-canary.0 up to but not including 4.0.0-canary.34. When client uploads are enabled for multiple collections sharing the same S3 bucket and the configuration useCompositePrefixes is false or unset, an authenticated user can overwrite existing S3 objects belonging to other collections. This bypasses the intended access controls and file validation mechanisms. The vulnerability is addressed in versions 3.90.0 and 4.0.0-canary.34.

An authenticated user with low privileges can overwrite files in S3 buckets belonging to other upload collections, bypassing access controls and file validation. This could lead to unauthorized modification or replacement of stored content, potentially impacting data integrity and security of the affected system.

A fix is available in PayloadCMS versions 3.90.0 and 4.0.0-canary.34. Users should upgrade to these versions or later to remediate this vulnerability. Since this is a cloud-hosted service, the vendor manages remediation for the cloud service; users should verify with the vendor advisory for confirmation of patch deployment. Until patched, ensure that useCompositePrefixes is enabled or properly configured to prevent this bypass.