{"id":"CVE-2026-93363","kind":"vulnerability","aliases":["CVE-2026-93363","GHSA-mc8m-rr6c-r5qr"],"related":[],"title":"@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter","description":"### Impact\nIn affected configurations, client upload access does not consistently align with the associated collection’s access configuration.\n\nYou are affected if:\n- You use client uploads with `@payloadcms/storage-vercel-blob`.\n- Authenticated users can access the client-upload route.\n\nApplications that do not enable client uploads are not affected.\n\n### Patches\nClient uploads now require authentication and the appropriate collection-level access before upload access is granted.\n\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.\n\n### Workarounds\nUpgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.","summary":"The Vercel Blob storage adapter for Payload CMS does not consistently enforce the collection's access rules on client uploads. An authenticated user can upload files to a collection they should not be allowed to write to.","severity":"medium","cvss":5.3,"epss":0.00177,"exploited":false,"exploited_at":null,"products":[{"name":"@payloadcms/storage-vercel-blob","fixed":["3.90.0"],"affected":">= 3.25.0, < 3.90.0","ecosystem":"npm"},{"name":"@payloadcms/storage-vercel-blob","fixed":["4.0.0-canary.34"],"affected":">= 4.0.0-canary.0, < 4.0.0-canary.34","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-862","node","npm","package","payload-cms","vercel-blob"],"not_affected_if":["client-uploads-disabled","other-storage-adapter","unauthenticated-only-route"],"how_to_check":"- Check the installed version of `@payloadcms/storage-vercel-blob` in your lockfile or with `npm ls @payloadcms/storage-vercel-blob`.\n- Check whether client uploads are enabled in the Vercel Blob adapter configuration (`clientUploads`).\n- Check whether the client-upload route is reachable by authenticated users.","fix":"- `@payloadcms/storage-vercel-blob` 3.x: upgrade to `3.90.0`\n- `@payloadcms/storage-vercel-blob` 4.0.0 canary: upgrade to `4.0.0-canary.34`","status":"open","published_at":"2026-09-25T17:17:19+00:00","first_seen_at":"2026-11-04T17:05:29+00:00","triaged_at":"2026-11-04T17:05:49+00:00","updated_at":"2026-11-04T17:28:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T17:05:49Z","model":"claude-haiku-5-5","output":{"fix":"- `@payloadcms/storage-vercel-blob` 3.x: upgrade to `3.90.0`\n- `@payloadcms/storage-vercel-blob` 4.0.0 canary: upgrade to `4.0.0-canary.34`","reach":"internet","title":"Payload storage adapter lets users bypass collection upload access rules","impact":"medium","summary":"The Vercel Blob storage adapter for Payload CMS does not consistently enforce the collection's access rules on client uploads. An authenticated user can upload files to a collection they should not be allowed to write to.","audience":"developers","category":"package","nicknames":[],"who_cares":["payload-cms","vercel-blob","node","npm"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users write files into collections they lack permission for.","analyst_note":"","how_to_check":"- Check the installed version of `@payloadcms/storage-vercel-blob` in your lockfile or with `npm ls @payloadcms/storage-vercel-blob`.\n- Check whether client uploads are enabled in the Vercel Blob adapter configuration (`clientUploads`).\n- Check whether the client-upload route is reachable by authenticated users.","plain_action":"","needs_analyst":false,"not_affected_if":["client-uploads-disabled","other-storage-adapter","unauthenticated-only-route"],"who_is_affected":"Only applications that use Payload CMS with the Vercel Blob storage adapter and have client uploads enabled are exposed. Authenticated users who can reach the client-upload route can upload into collections their role should not allow. Applications without client uploads are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000757,"input_tokens":4478,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-862':26B '-93363':14A,22A '3.90.0':143C '4.0.0':145C 'access':3A,51B,78C,88C,103C,131C,134C,168C 'adapt':11A,40B 'affect':74C,92C,118C 'align':82C 'allow':69B 'applic':109C 'appropri':127C 'associ':85C,173C 'authent':57B,100C,124C 'blob':35B,38B 'bypass':5A 'canary.34':146C 'client':54B,76C,96C,106C,114C,120C,160C 'client-upload':105C 'cms':32B,43B 'collect':49B,64B,86C,129C,174C 'collection-level':128C 'configur':75C,89C,163C 'consist':46B,81C 'control':4A,169C 'cve':12A,20A 'cwe':25B 'disabl':159C 'enabl':113C 'enforc':47B,171C 'file':61B 'ghsa':16A 'ghsa-mc8m-rr6c-r5qr':15A 'grant':136C 'impact':72C 'level':130C 'mc8m':17A 'node':27B 'npm':28B 'packag':29B,141C 'patch':119C,151C 'payload':31B,42B,140C 'payload-cm':30B 'payloadcms/storage-vercel-blob':1A,23A,24A,99C 'permiss':176C 'r5qr':19A 'recommend':154C 'requir':123C 'rout':108C,166C 'rr6c':18A 'rule':52B 'storag':10A,39B 'upgrad':139C,148C,158C 'upload':7A,55B,60B,77C,97C,107C,115C,121C,133C,161C,165C 'use':95C 'user':58B,101C,137C 'vercel':9A,34B,37B 'vercel-blob':33B 'version':152C 'workaround':147C 'write':71B","nicknames":[],"mitigations":[],"who_affected":"Only applications that use Payload CMS with the Vercel Blob storage adapter and have client uploads enabled are exposed. Authenticated users who can reach the client-upload route can upload into collections their role should not allow. Applications without client uploads are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["storagevercelblob"],"ptokens":["blob","payloadcms","storage","vercel"],"labels":["cwe862","medium","node","npm","package","payloadcms","vercelblob"],"campaign_type":null,"first_public_at":"2026-09-25T13:57:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-mc8m-rr6c-r5qr","url":"https://github.com/advisories/GHSA-mc8m-rr6c-r5qr","severity":"medium","published_at":"2026-11-04T17:00:39+00:00","modified_at":"2026-11-04T17:00:40+00:00","first_seen_at":"2026-11-04T17:05:29+00:00","fetched_at":"2026-11-04T17:05:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-93363","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93363","severity":null,"published_at":"2026-09-25T17:17:19+00:00","modified_at":"2026-09-30T17:31:44+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","fetched_at":"2026-11-04T17:28:12+00:00","note":null}],"documents":[{"id":68780,"url":"https://api.github.com/repos/payloadcms/payload/security-advisories/GHSA-mc8m-rr6c-r5qr","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":68781,"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-mc8m-rr6c-r5qr","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-09-25T13:57:20+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":68782,"url":"https://github.com/payloadcms/payload/commit/47abe9bb5c444330dbfaa9a5bc2033337932270b","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":43103,"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68878,"url":"https://www.vulncheck.com/advisories/payload-cms-storage-vercel-blob-adapter-improper-access-control-on-upload-route","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}