CVE-2026-93363
Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement.
- Record
CVE-2026-93363- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-87206
@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter
- Record
EUVD-2026-87206- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-mc8m-rr6c-r5qr
@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter
Impact
In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.
You are affected if:
- You use client uploads with
@payloadcms/storage-vercel-blob. - Authenticated users can access the client-upload route.
Applications that do not enable client uploads are not affected.
Patches
Client uploads now require authentication and the appropriate collection-level access before upload access is granted.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.
- Record
GHSA-mc8m-rr6c-r5qr- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-04
NVD
The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement.
- Record
CVE-2026-93363- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement.
- Record
CVE-2026-93363- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-mc8m-rr6c-r5qr
@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter
Impact
In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.
You are affected if:
- You use client uploads with
@payloadcms/storage-vercel-blob. - Authenticated users can access the client-upload route.
Applications that do not enable client uploads are not affected.
Patches
Client uploads now require authentication and the appropriate collection-level access before upload access is granted.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.
- Record
GHSA-mc8m-rr6c-r5qr- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@payloadcms/storage-vercel-blobnpm |
3.25.0 up to 3.90.0 | 3.90.0 |
@payloadcms/storage-vercel-blobnpm |
4.0.0-canary.0 up to 4.0.0-canary.34 | 4.0.0-canary.34 |
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| affected, references | OSV | |
| affected, facts, references | GitHub Advisories | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-93363 is a medium vulnerability (CVSS 5.3) in Payloadcms Payload, published September 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in @payloadcms/storage-vercel-blob 3.90.0.
References
github.com/payloadcms/payload/security/advisories/GHSA-mc8m-rr6c-r5qr
vulncheck.com/advisories/payload-cms-storage-vercel-blob-adapter-improper-access-control-on-upload-route
nvd.nist.gov/vuln/detail/CVE-2026-93363