AIKIDO-2026-339674

TL;DR

With TUS resumable uploads enabled, the endpoint did not enforce item-level authorization on the file targeted by an upload replacement. An earlier fix validated the id upload metadata key, but the completion handlers acted on an adjacent replace_id key that was never checked against the caller, and the referenced record was rewritten by an internal service running without accountability. An authenticated user holding create and update permission on files could overwrite any other user's file contents and privileged metadata by naming the victim's file id, destroying the original object and its thumbnails. The fix enforces authorization on the replacement target and applies storage path and uniqueness checks.