CVE-2026-93363: Payload CMS Vercel Blob Auth Bypass Flaw

CVE-2026-93363 Overview

CVE-2026-93363 is an improper access control vulnerability [CWE-862] in the @payloadcms/storage-vercel-blob storage adapter for Payload CMS. The adapter exposes a client-upload route that fails to enforce collection-level permissions. Authenticated users can call the route directly and upload files to collections they are not authorized to modify. The flaw bypasses Payload's intended access control model for file uploads backed by Vercel Blob storage.

Critical Impact
Authenticated users can upload arbitrary files to protected collections by invoking the client-upload endpoint, bypassing collection-level authorization checks.

Affected Products

Payload CMS @payloadcms/storage-vercel-blob storage adapter
Payload applications using the Vercel Blob adapter with client-upload enabled
Deployments relying on collection-level access control for upload authorization

Discovery Timeline

2026-09-25 - CVE-2026-93363 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-93363

Vulnerability Analysis

The @payloadcms/storage-vercel-blob adapter integrates Vercel Blob object storage with Payload CMS collections. To support direct browser-to-storage uploads, the adapter exposes a client-upload route that returns upload tokens for the Vercel Blob service. The route authenticates the caller but does not validate that the authenticated user has create or update access to the target collection.

Any authenticated user can invoke the client-upload endpoint and receive a valid upload token for a collection they should not be able to modify. The subsequent upload to Vercel Blob succeeds because token issuance already took place server-side. The vulnerability affects the integrity of files served from protected collections but does not expose confidential data or impact availability.

Root Cause

The root cause is a missing authorization check [CWE-862] in the client-upload route handler. The handler verifies session authentication but omits the collection access evaluation that other upload paths perform. Collection-level access.create and access.update functions are not invoked before issuing an upload token.

Attack Vector

The attack requires network access to the Payload application and valid low-privilege credentials. An attacker authenticates to the Payload instance, then issues an HTTP request to the client-upload route with a target collection slug. The server responds with an upload token the attacker uses to write files into the collection, circumventing the configured access control.

No verified exploit code is published. See the GitHub Security Advisory and the VulnCheck Security Advisory for additional technical details.

Detection Methods for CVE-2026-93363

Indicators of Compromise

Requests to the client-upload route originating from user accounts that lack collection write permissions
Unexpected objects appearing in Vercel Blob storage buckets tied to restricted collections
Payload audit records showing upload events without a corresponding collection permission grant

Detection Strategies

Correlate web server access logs for the client-upload path against the role of the authenticated user and the target collection's access policy
Compare file creation events in Vercel Blob with the Payload user's assigned collection permissions and alert on mismatches
Review application logs for upload token issuance events that lack a preceding authorization check

Monitoring Recommendations

Enable verbose logging on the Payload admin API and ship logs to a centralized analytics platform for review
Monitor Vercel Blob storage for unexpected growth, unusual MIME types, or files created outside expected upload workflows
Alert on authenticated API traffic from accounts that normally do not perform upload activity

How to Mitigate CVE-2026-93363

Immediate Actions Required

Upgrade @payloadcms/storage-vercel-blob to the patched release referenced in the GitHub Security Advisory
Audit Vercel Blob storage for files uploaded by low-privilege accounts since deployment of the adapter
Review and tighten role assignments so that only accounts requiring upload access retain it

Patch Information

Payload has published a fix in the @payloadcms/storage-vercel-blob package. Consult the GitHub Security Advisory GHSA-mc8m-rr6c-r5qr for the fixed version numbers and upgrade guidance. Rebuild and redeploy any application that bundles the adapter after upgrading.

Workarounds

Disable the client-upload feature of the Vercel Blob adapter and route uploads through the server-side upload path until patched
Restrict network access to the Payload admin API so only trusted accounts can reach the client-upload route
Apply reverse-proxy rules that block requests to the client-upload endpoint from users not in an authorized role group

bash

# Example: upgrade the Payload Vercel Blob storage adapter to the patched version
npm install @payloadcms/storage-vercel-blob@latest
# Verify the installed version resolves above the vulnerable release
npm ls @payloadcms/storage-vercel-blob