GHSA-mc8m-rr6c-r5qr: @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter
Impact In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.
You are affected if: - You use client uploads with @payloadcms/storage-vercel-blob. - Authenticated users can access the client-upload route.
Applications that do not enable client uploads are not affected.
Patches Client uploads now require authentication and the appropriate collection-level access before upload access is granted.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@payloadcms/storage-vercel-blobto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/@payloadcms/storage-vercel-blobto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Configuration
Disable client uploads until upgrading.
@payloadcms/storage-vercel-blob client uploads = disabled - Configuration
Configure the upload route's access control to enforce the associated collection's permissions until upgrading.
@payloadcms/storage-vercel-blob upload route access control = enforce the associated collection's permissions
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use client uploads with @payloadcms/storage-vercel-blob and allow authenticated users to access the client-upload route. Applications that do not enable client uploads are not affected.
What level of access does an attacker need?
An attacker needs an authenticated account that can access the client-upload route. The issue is that upload access may not consistently enforce the associated collection's access configuration.
What should we do if we cannot upgrade immediately?
Disable client uploads, or configure the upload route's access control to enforce the permissions of the associated collection. Upgrading Payload packages to >= 3.90.0 or >= 4.0.0-canary.34 is the recommended remediation.