In older releases of Payload CMS, an authenticated user can overwrite S3 objects that belong to another upload collection when client uploads are enabled for multiple collections that share a bucket and the configuration flag useCompositePrefixes is either false or unset. This allows the attacker to bypass the target collection’s access controls and the system’s prior file type validation, resulting in unauthorized modification of stored files.

The vulnerability affects Payload CMS products: storage‑s3 versions earlier than 3.90.0 and canary releases earlier than 4.0.0‑canary.34, as well as the main Payload package in versions that include the problematic storage module. Users running these affected versions are at risk if they enable client uploads for more than one collection using a single S3 bucket.

The CVSS score of 7.1 indicates a high level of severity. Although the EPSS score is currently unavailable, there is no indication that the vulnerability is listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. The necessary conditions for exploitation are an authenticated user with upload privileges and a configuration that permits multiple collections in one bucket without composite prefixes. When these conditions are met, an attacker can replace existing files, potentially compromising data integrity and exposing sensitive assets.