How to safely allow user upload on CPTs?

If I understood correctly the situation described in the question and its comments, the user has capabilities to upload files and to edit your post type, so you shouldn’t be fitering capabilities, the user already has the correct capabilities.

The problem is that wp_editor() use the global $post by default, and in your context the global $post is for the page where you embed the editor.

The solution: set the global $post to the post being edited before executing wp_editor():

global $post;
// Set the global post to your post object
// Exmple if the ID of your post is 2
$post = get_post( 2 );
wp_editor();

If you are in a new post form:

global $post;
// Get default post object of my_post_type
$post = get_default_post_to_edit( 'my_post_type', true );
wp_editor();