AIKIDO-2026-682474

TL;DR

Craft Cloud's actionGetUploadUrl() controller action resolves the target asset folder and generates a presigned upload URL before checking the folder's saveAssets, replaceFiles, or replacePeerFiles volume permission. An authenticated user without access to a folder can obtain a working presigned upload URL for that folder even though the later asset creation step still denies them. The fix moves the permission checks before the presigned URL is generated and rejects requests that reference a non-existent replacement asset.