Description
The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement.
Published: 2026-09-25
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized File Upload
Action: Apply Patch
AI Analysis

Impact

An improper access control flaw in the @payloadcms/storage-vercel-blob adapter lets authenticated users upload files to the client-upload endpoint without the necessary collection‐level permissions. The weakness, identified as CWE‑862, allows attackers to bypass intended access controls and store arbitrary data in the system, which could further enable malicious file execution or data corruption.

Affected Systems

The vulnerability affects Payload CMS, specifically the storage-vercel-blob adapter. No specific version information is disclosed; any deployment that uses the affected adapter is at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity potential impact. EPSS data is unavailable, and the issue is not listed in CISA KEV, suggesting limited public exploitation. Attackers would need to be authenticated but can circumvent collection permissions by directly invoking the client-upload route, a remote attack path through the web interface.

Generated by OpenCVE AI on September 25, 2026 at 20:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched version of the @payloadcms/storage-vercel-blob adapter that enforces collection-level permissions on uploads.
  • If the upload endpoint is not required for your use case, disable or remove the client-upload route from the application.
  • Audit existing user permissions and implement stricter collection access controls, and monitor upload activity for unauthorized uploads.

Generated by OpenCVE AI on September 25, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:payloadcms:payload:*:*:*:*:*:*:*:*

Sat, 26 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Payloadcms
Payloadcms payload
Vendors & Products Payloadcms
Payloadcms payload

Fri, 25 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
Description The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement.
Title Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Payloadcms Payload
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-01T15:22:00.369Z

Reserved: 2026-09-17T18:41:40.758Z

Link: CVE-2026-93363

cve-icon Vulnrichment

Updated: 2026-09-25T17:08:22.167Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-25T17:17:19.157

Modified: 2026-09-30T17:31:44.573

Link: CVE-2026-93363

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T11:00:06Z

Weaknesses