{"id":"EUVD-2026-93513","enisaUuid":"629e4e07-481d-3b5d-bc48-d4c2ecff9737","description":"Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection\u0027s access controls and prior file validation. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:49:12 PM","dateUpdated":"Oct 6, 2026, 5:24:39 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-7vg8-29qx-jgj8\nhttps://github.com/payloadcms/payload/commit/2df8238fbf17edfce335c399b90bf524ba9906a2\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105867\nGHSA-7vg8-29qx-jgj8\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"073ba174-b965-36af-8cd7-095768e8f110","product":{"name":"storage-s3","vendor":{"name":"@payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"3a4de7da-cfa7-381b-8f2c-79a32b6c27a4","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"8eeba791-c81e-372d-8fa2-4c4bfa3a07bc","product":{"name":"storage-s3","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"ae7ad368-1db5-3237-91a4-dda9b854c870","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"enisaIdVendor":[{"id":"58471361-4ff8-3d75-929a-4957caa34368","vendor":{"name":"@payloadcms"}},{"id":"d7b6763c-8c5e-365e-87d3-21cafd26a320","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"0bb8b554-4605-343c-b1fe-283417730035","vulnerability":{"id":"CVE-2026-105867","description":"Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection\u0027s access controls and prior file validation. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:49:12 PM","dateUpdated":"Oct 6, 2026, 5:24:39 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-7vg8-29qx-jgj8\nhttps://github.com/payloadcms/payload/commit/2df8238fbf17edfce335c399b90bf524ba9906a2\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93513\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Oct 29, 2026, 7:15:56 AM","vulnerabilityProduct":[{"id":"071e19cc-bf03-3586-b345-92a3eb65288f","product":{"name":"storage-s3","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"21ae9aa6-2f05-315b-aaa1-01bff831b37d","product":{"name":"storage-s3","vendor":{"name":"@payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"3bcc7373-852a-39fe-a7ce-f6e82f97f9cd","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"56b7b326-6e1c-3086-8740-d6b75d3cb307","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"vulnerabilityVendor":[{"id":"12c53983-eb45-3fcd-808a-7f41220c31b2","vendor":{"name":"@payloadcms"}},{"id":"4506c62c-21cb-3ea4-8c44-54ff3e9ccaee","vendor":{"name":"payloadcms"}}]}},{"id":"e6824ce4-c370-3d8c-9ea0-531731d46cfc","vulnerability":{"id":"GHSA-7vg8-29qx-jgj8","description":"Payload: Client uploads could overwrite S3 objects","datePublished":"Oct 7, 2026, 8:28:59 PM","dateUpdated":"Oct 7, 2026, 8:28:59 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-7vg8-29qx-jgj8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105867\nhttps://github.com/payloadcms/payload/commit/2df8238fbf17edfce335c399b90bf524ba9906a2\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93513\n","aliases":"GHSA-7vg8-29qx-jgj8\nCVE-2026-105867\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}