MEDIUM 4.3 GitHub
CVE-2026-93363
@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter
### Impact
In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.
You are affected if:
- You use client uploads with `@payloadcms/storage-vercel-blob`.
- Authenticated users can access the client-upload route.
Applications that do not enable client uploads are not affected.
### Patches
Client uploads now require authentication and the appropriate collection-level access before upload access is granted.
Users should
Affected Products
- npm/@payloadcms/storage-vercel-blob >= 3.25.0, < 3.90.0
- npm/@payloadcms/storage-vercel-blob >= 4.0.0-canary.0, < 4.0.0-canary.34
References
- https://github.com/advisories/GHSA-mc8m-rr6c-r5qr
- https://github.com/payloadcms/payload/security/advisories/GHSA-mc8m-rr6c-r5qr
- https://nvd.nist.gov/vuln/detail/CVE-2026-93363
- https://github.com/payloadcms/payload/commit/47abe9bb5c444330dbfaa9a5bc2033337932270b
This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-11-04 via GitHub. Affected: npm/@payloadcms/storage-vercel-blob >= 3.25.0, < 3.90.0, npm/@payloadcms/storage-vercel-blob >= 4.0.0-canary.0, < 4.0.0-canary.34.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.