Currently WP_REST_Attachments_Controller::create_item_permissions_check() checks $post_type_obj->cap->create_posts which returns the attachment-specifc "upload_files", but also $post_type_obj->cap->edit_posts which returns the general "edit_posts".

I suggest that edit_posts should not be required if the user can upload_files, as there is then no way via map_meta_cap to modify the API to allow a Subscriber (for example) to be able to submit attachments with the intention of allowing them to use a second API call to attach the attachment to a custom post type that is not 'post' (where that post type is registered using capability_type).

Unless there's a way I'm missing of submitting the attachment upload in such a way that satisfies this constraint?