---
id: "CVE-2026-93363"
kind: "vulnerability"
aliases: ["CVE-2026-93363", "GHSA-mc8m-rr6c-r5qr"]
title: "@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter"
severity: "medium"
cvss: 5.3
epss: 0.00177
exploited: false
status: "open"
category: "package"
products: [{"name": "@payloadcms/storage-vercel-blob", "fixed": ["3.90.0"], "affected": ">= 3.25.0, < 3.90.0", "ecosystem": "npm"}, {"name": "@payloadcms/storage-vercel-blob", "fixed": ["4.0.0-canary.34"], "affected": ">= 4.0.0-canary.0, < 4.0.0-canary.34", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-862", "node", "npm", "package", "payload-cms", "vercel-blob"]
not_affected_if: ["client-uploads-disabled", "other-storage-adapter", "unauthenticated-only-route"]
published_at: "2026-09-25T17:17:19+00:00"
first_seen_at: "2026-11-04T17:05:29+00:00"
updated_at: "2026-11-04T17:28:12+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-mc8m-rr6c-r5qr", "first_seen_at": "2026-11-04T17:05:29+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93363", "first_seen_at": "2026-11-04T17:28:12+00:00"}]
---

# @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter

The Vercel Blob storage adapter for Payload CMS does not consistently enforce the collection's access rules on client uploads. An authenticated user can upload files to a collection they should not be allowed to write to.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@payloadcms/storage-vercel-blob affected >= 3.25.0, < 3.90.0 fixed 3.90.0
- npm:@payloadcms/storage-vercel-blob affected >= 4.0.0-canary.0, < 4.0.0-canary.34 fixed 4.0.0-canary.34

## How to check

- Check the installed version of `@payloadcms/storage-vercel-blob` in your lockfile or with `npm ls @payloadcms/storage-vercel-blob`.
- Check whether client uploads are enabled in the Vercel Blob adapter configuration (`clientUploads`).
- Check whether the client-upload route is reachable by authenticated users.

## Fix

- `@payloadcms/storage-vercel-blob` 3.x: upgrade to `3.90.0`
- `@payloadcms/storage-vercel-blob` 4.0.0 canary: upgrade to `4.0.0-canary.34`

## Timeline

- 2026-11-04T17:05:29+00:00 ghsa https://github.com/advisories/GHSA-mc8m-rr6c-r5qr
- 2026-11-04T17:28:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93363

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/payloadcms/payload/security-advisories/GHSA-mc8m-rr6c-r5qr
- [advisory] Maintainer's advisory: github.com https://github.com/payloadcms/payload/security/advisories/GHSA-mc8m-rr6c-r5qr
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/payload-cms-storage-vercel-blob-adapter-improper-access-control-on-upload-route
- [fix] Patch: github.com https://github.com/payloadcms/payload/commit/47abe9bb5c444330dbfaa9a5bc2033337932270b
- [fix] Patch: github.com https://github.com/payloadcms/payload/releases/tag/v3.90.0

## From the sources

### Impact
In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.

You are affected if:
- You use client uploads with `@payloadcms/storage-vercel-blob`.
- Authenticated users can access the client-upload route.

Applications that do not enable client uploads are not affected.

### Patches
Client uploads now require authentication and the appropriate collection-level access before upload access is granted.

Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

### Workarounds
Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_