CVE-2026-93363GHSA-mc8m-rr6c-r5qr
Impact
In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.
You are affected if:
@payloadcms/storage-vercel-blob.Applications that do not enable client uploads are not affected.
Patches
Client uploads now require authentication and the appropriate collection-level access before upload access is granted.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.
AI analysis
Not analysed yet.
Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.
| Product | Affected versions | Fixed in | Source |
|---|---|---|---|
| @payloadcms/storage-vercel-blobnpm | >= 3.25.0, < 3.90.0>= 4.0.0-canary.0, < 4.0.0-canary.34 | 3.90.04.0.0-canary.34 | GitHub |
0.2%7th percentile
Bar shows rank among all scored CVEs.
Published
First publication at the source
Last modified
Latest change at the source
Collected
First seen by Baba Yaga Security