CVE-2026-93363 with a CVSS score of 5.3 is a medium-severity access control bypass in the Vercel Storage adapter for Payload CMS, specifically the @payloadcms/storage-vercel-blob npm package. The affected versions are @payloadcms/storage-vercel-blob (npm) versions 3.25.0 or later, but before 3.90.0, and @payloadcms/storage-vercel-blob (npm) versions 4.0.0-canary.0 or later, but before 4.0.0-canary.34. The flaw occurs when client uploads are enabled and an authenticated user can reach the client-upload route, because upload access does not consistently align with the associated collection’s access configuration. An attacker with low privileges and network access can exploit the upload route without user interaction, potentially uploading content or manipulating storage behavior beyond the permissions intended for the collection. Applications that do not enable client uploads are not affected. The business impact is that unauthorized or overly permissive uploads can compromise data integrity, expose sensitive storage locations, create unauthorized content, and undermine trust in the application’s access controls, potentially leading to operational disruption, compliance issues, and increased risk of further abuse.
We recommend you to update @payloadcms/storage-vercel-blob to version 3.90.0 or 4.0.0-canary.34 depending on your installed branch.[/subscribe_to_unlock_form]
CVE-2026-93363 with a CVSS score of 5.3 is a medium-severity access control bypass in the Vercel Storage adapter for Payload CMS, specifically the @payloadcms/storage-vercel-blob npm package. The affected versions are @payloadcms/storage-vercel-blob (npm) versions 3.25.0 or later, but before 3.90.0, and @payloadcms/storage-vercel-blob (npm) versions 4.0.0-canary.0 or later, but before 4.0.0-canary.34. The flaw occurs when client uploads are enabled and an authenticated user can reach the client-upload route, because upload access does not consistently align with the associated collection’s access configuration. An attacker with low privileges and network access can exploit the upload route without user interaction, potentially uploading content or manipulating storage behavior beyond the permissions intended for the collection. Applications that do not enable client uploads are not affected. The business impact is that unauthorized or overly permissive uploads can compromise data integrity, expose sensitive storage locations, create unauthorized content, and undermine trust in the application’s access controls, potentially leading to operational disruption, compliance issues, and increased risk of further abuse.
We recommend you to update @payloadcms/storage-vercel-blob to version 3.90.0 or 4.0.0-canary.34 depending on your installed branch.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]