JEDI-SEC | Security Research & Digital Defense

GHSA-mc8m-rr6c-r5qr: @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter

Written by

jedisec_u136k7

in

  • Severity: MEDIUM
  • CVE: CVE-2026-93363
  • Ecosystems: npm, npm
  • Packages: @payloadcms/storage-vercel-blob, @payloadcms/storage-vercel-blob

### Impact
In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.

You are affected if:
– You use client uploads with `@payloadcms/storage-vercel-blob`.
– Authenticated users can access the client-upload route.

Applications that do not enable client uploads are not affected.

### Patches
Client uploads now require authentication and the appropriate collection-level access before upload access is granted.

Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

### Workarounds
Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.

Source: GitHub Security Advisories · 2026-11-04

More posts