Is CVE-2026-105867 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105867 being exploited in the wild.

How severe is CVE-2026-105867?

High severity, with a CVSS score of 4, published 6 October 2026.

Which products and versions are affected?

@payloadcms/storage-s3 (npm) SEMVER:introduced=0,fixed=3.90.0; Payload CMS @Payloadcms/Storage-S3 before 3.90.0 and canary versions before 4.0.0-canary.34.

How is CVE-2026-105867 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-105867?

Check whether you run @payloadcms/storage-s3 (npm) or Payload CMS @Payloadcms/Storage-S3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105867: Payload CMS S3 storage client upload access control bypass

CVE-2026-105867 · Severity: high · CVSS 4 · Published 2026-10-06

Payload CMS is a headless content management system that stores uploads in Amazon S3. When client uploads are enabled for multiple collections sharing an S3 bucket without composite prefixes, an authenticated user can overwrite files from other collections, bypassing access controls and file validation. This allows attackers to modify or replace files they should not have permission to access.

Vendors: npm, Payload CMS.

Quick answers

Is CVE-2026-105867 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105867 being exploited in the wild.
How severe is CVE-2026-105867?: High severity, with a CVSS score of 4, published 6 October 2026.
Which products and versions are affected?: @payloadcms/storage-s3 (npm) SEMVER:introduced=0,fixed=3.90.0; Payload CMS @Payloadcms/Storage-S3 before 3.90.0 and canary versions before 4.0.0-canary.34.
Is there a fix for CVE-2026-105867?: Yes. @payloadcms/storage-s3 (npm): upgrade to 3.90.0 or later. Until then: Enable useCompositePrefixes in the S3 storage adapter configuration to ensure collections use separate prefixes, or restrict client uploads to a single collection per S3 bucket. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105867 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-105867?: Check whether you run @payloadcms/storage-s3 (npm) or Payload CMS @Payloadcms/Storage-S3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@payloadcms/storage-s3 (npm): upgrade to 3.90.0 or later
```
npm install @payloadcms/storage-s3@3.90.0
```

Enable useCompositePrefixes in the S3 storage adapter configuration to ensure collections use separate prefixes, or restrict client uploads to a single collection per S3 bucket.

Technical details

The @payloadcms/storage-s3 adapter fails to properly isolate S3 objects between collections when clientUploads is enabled, useCompositePrefixes is false or unset, and multiple collections share the same bucket. An authenticated user can craft requests to overwrite existing S3 objects belonging to another collection. The fix adds If-None-Match headers to prevent overwrites of existing objects during client uploads.

Affected products

Payload CMS @payloadcms/storage-s3 before 3.90.0 and canary versions before 4.0.0-canary.34

Identifiers

CVE-2026-105867
GHSA-7vg8-29qx-jgj8

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.