Rclone versions from 1.68.0 up to but not including 1.75.2 contain an authorization bypass vulnerability in the serve s3 --auth-proxy feature. This flaw allows authenticated tenants to manipulate multipart uploads belonging to other tenants by referencing their upload IDs. Attackers who know a victim's bucket, object, and upload ID can inject parts, complete, or abort uploads in progress and view metadata across tenants. The issue is fixed in version 1.75.2.