The Drupal S3fs CORS module allows direct browser uploads to Amazon S3 and registers them as Drupal files, bypassing PHP file size and timeout limits. A vulnerability exists due to insufficient access checks on file uploads, enabling certain users to delete files they should not have permission to delete. This issue affects versions prior to 1.3.0 and has been fixed in version 1.3.0.