CVE-2026-93363Published
Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-93363 · Microsoft / collected KEV context
cve-program · CVE-2026-93363
- https://github.com/payloadcms/payload/security/advisories/GHSA-mc8m-rr6c-r5qr
- https://www.vulncheck.com/advisories/payload-cms-storage-vercel-blob-adapter-improper-access-control-on-upload-route
euvd · EUVD-2026-87206
- https://github.com/payloadcms/payload/security/advisories/GHSA-mc8m-rr6c-r5qr
- https://www.vulncheck.com/advisories/payload-cms-storage-vercel-blob-adapter-improper-access-control-on-upload-route
nvd · CVE-2026-93363
- https://github.com/payloadcms/payload/security/advisories/GHSA-mc8m-rr6c-r5qr
- https://www.vulncheck.com/advisories/payload-cms-storage-vercel-blob-adapter-improper-access-control-on-upload-route
osv · GHSA-mc8m-rr6c-r5qr
- https://github.com/payloadcms/payload/security/advisories/GHSA-mc8m-rr6c-r5qr
- https://nvd.nist.gov/vuln/detail/CVE-2026-93363
- https://github.com/payloadcms/payload/commit/47abe9bb5c444330dbfaa9a5bc2033337932270b
- https://github.com/payloadcms/payload
- https://github.com/payloadcms/payload/releases/tag/v3.90.0
- https://www.vulncheck.com/advisories/payload-cms-storage-vercel-blob-adapter-improper-access-control-on-upload-route
Related operational evidence
Explicit CVE identifiers- The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attacker… · Advisory content revised · 8 Nov 2026
- @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter · Newly collected advisory · 4 Nov 2026