The vulnerability (CVE-2026-58200) affects the @jhb.software/payload-cloudinary-plugin when clientUploads is enabled. The POST /api/cloudinary-generate-signature endpoint passes attacker-controlled body.paramsToSign directly to cloudinary.utils.api_sign_request without enforcing a key allowlist, collection policy, timestamp freshness, or folder restrictions. This allows any authenticated Payload user to generate valid Cloudinary HMAC-SHA1 signatures for unauthorized parameters such as overwrite, type, notification_url, invalidate, folder, and public_id. Consequently, attackers can perform unauthorized asset replacement, change upload visibility, trigger callbacks to attacker-chosen URLs, invalidate caches, and upload files outside the intended folder. The vulnerability is resolved in version 0.4.0.

The vulnerability allows authenticated users to bypass intended restrictions on Cloudinary asset management by generating valid signatures for unauthorized operations. This can lead to unauthorized modification or replacement of assets, changes in upload visibility, triggering of callbacks to attacker-controlled URLs, cache invalidation, and uploads outside designated folders. There is no confidentiality impact reported, but integrity is highly impacted and availability impact is low.

Upgrade to version 0.4.0 or later of the payload-plugins where this vulnerability is fixed. No other mitigation is indicated or required by the vendor advisory.