CVE-2026-93363 — Vulnerability intelligence
— @payloadcms/storage-vercel-blob, @payloadcms/storage-vercel-blob
Published:
- CVSS
- 4.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter
### Impact
In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.
You are affected if:
- You use client uploads with `@payloadcms/storage-vercel-blob`.
- Authenticated users can access the client-upload route.
Applications that do not enable client uploads are not affected.
### Patches
Client uploads now require authentication and the appropriate collection-level access before upload access is granted.
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
### Workarounds
Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.