diff --git a/changelogs/client_server/newsfragments/1872.clarification b/changelogs/client_server/newsfragments/1872.clarification
new file mode 100644
index 00000000..4bcea39e
--- /dev/null
+++ b/changelogs/client_server/newsfragments/1872.clarification
@@ -0,0 +1 @@
+Clarify that `/media/v3/upload/{serverName}/{mediaId}` requires authentication.
diff --git a/data/api/client-server/content-repo.yaml b/data/api/client-server/content-repo.yaml
index 038ac618..d0a6e5bb 100644
--- a/data/api/client-server/content-repo.yaml
+++ b/data/api/client-server/content-repo.yaml
@@ -81,6 +81,9 @@ paths:
         earlier via [POST /_matrix/media/v1/create](/client-server-api/#post_matrixmediav1create).
       operationId: uploadContentToMXC
       x-addedInMatrixVersion: "1.7"
+      security:
+        - accessTokenQuery: []
+        - accessTokenBearer: []
       parameters:
         - $ref: '#/components/parameters/serverName'
           description: |