CVE-2026-93363: Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to access the client-upload route. No user interaction is required, and the issue is reachable over the network.
What access does an attacker need before exploiting it?
The attacker needs a valid authenticated account, but does not need the collection-level permissions that would normally be required to upload files. The flaw bypasses those intended collection access checks through the client-upload endpoint.
What is the likely impact of successful exploitation?
Successful exploitation allows unauthorized file uploads, resulting in an integrity impact. The provided data does not indicate confidentiality disclosure or availability impact.