@PAYLOADCMS/STORAGE-VERCEL-BLOB · CVE-2026-93363 · Package
FIX → 3.90.0 · 4.0.0-canary.34
The Vercel Blob storage adapter for Payload CMS does not consistently enforce the collection's access rules on client uploads. An authenticated user can upload files to a collection they should not be allowed to write to.
first public Sep 25, 2026 · 2 sources
Running @payloadcms/storage-vercel-blob? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only applications that use Payload CMS with the Vercel Blob storage adapter and have client uploads enabled are exposed. Authenticated users who can reach the client-upload route can upload into collections their role should not allow. Applications without client uploads are not affected.
Not affected if client-uploads-disabled, other-storage-adapter, unauthenticated-only-route
Who cares cwe-862, node, npm, payload-cms, vercel-blob
@payloadcms/storage-vercel-blob in your lockfile or with npm ls @payloadcms/storage-vercel-blob.clientUploads).Upgrade to 3.90.0 · 4.0.0-canary.34
@payloadcms/storage-vercel-blob 3.x: upgrade to 3.90.0@payloadcms/storage-vercel-blob 4.0.0 canary: upgrade to 4.0.0-canary.34In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.
You are affected if:
@payloadcms/storage-vercel-blob.Applications that do not enable client uploads are not affected.
Client uploads now require authentication and the appropriate collection-level access before upload access is granted.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.
This page as .md · .json · in your agent: get_signal("CVE-2026-93363") · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.