Résumé
Payload: Client uploads could overwrite S3 objects
Détails de l’avis
Impact
An authenticated user could overwrite an existing S3 object belonging to another upload collection, bypassing that collection’s access controls and prior file validation.
You are affected if ALL of these are true:
- Client uploads are enabled for multiple collections that share an S3 bucket.
- useCompositePrefixes is not configured or is set to
false.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Disable client uploads until you can upgrade.
Références
- https://github.com/advisories/GHSA-7vg8-29qx-jgj8
- https://github.com/payloadcms/payload/security/advisories/GHSA-7vg8-29qx-jgj8
- https://nvd.nist.gov/vuln/detail/CVE-2026-105867
- https://github.com/payloadcms/payload/commit/2df8238fbf17edfce335c399b90bf524ba9906a2
- https://github.com/payloadcms/payload/releases/tag/v3.90.0
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-107850
Contao: Improper access control in the preview links module
- MEDIUMCVE-2026-91980
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
- MEDIUMCVE-2026-91984
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
- HIGHCVE-2026-91985
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
- HIGHCVE-2026-76216
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
- CRITICALCVE-2026-68582
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)