CVE-2026-93363: Improper Access Control in Payload CMS Storage Upload Route

Vulnerability ID: CVE-2026-93363
CVSS Score: 4.3
Published: 2026-11-04

Payload CMS contains a missing authorization vulnerability (CWE-862) in its client-side upload instructions endpoint and the @payloadcms/storage-vercel-blob storage adapter. Two distinct logic defects allow authenticated users lacking collection-level create or update permissions to generate signed upload tokens and upload arbitrary files directly to external cloud storage.

TL;DR

Authenticated low-privileged users can bypass collection-level access controls in Payload CMS (versions 3.25.0 to < 3.90.0 and 4.0.0-canary.0 to < 4.0.0-canary.34) by directly querying /api/upload-instructions when using third-party storage adapters like @payloadcms/storage-vercel-blob, or by injecting overrideAccess: true into the JSON request body.

Technical Details

• Vulnerability Type: Missing Authorization (CWE-862)
• CVSS v3.1 Score: 4.3 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
• CVSS v4.0 Score: 5.3 Medium (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N)
• EPSS Score: 0.18% (7.28th percentile)
• Attack Vector: Network via POST /api/upload-instructions
• Affected Versions: 3.25.0 to < 3.90.0; 4.0.0-canary.0 to < 4.0.0-canary.34
• Patched Versions: 3.90.0, 4.0.0-canary.34
• CISA KEV Status: Not Listed

Affected Systems

• Payload CMS (payload)
• Payload CMS Vercel Blob Storage Adapter (@payloadcms/storage-vercel-blob)
• Payload CMS Cloudflare R2 Storage Adapter (@payloadcms/storage-r2)
• payload / @payloadcms/storage-vercel-blob: >= 3.25.0, < 3.90.0 (Fixed in: 3.90.0)
• payload / @payloadcms/storage-vercel-blob: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: 4.0.0-canary.34)

Code Analysis

Commit: 47abe9b

Enforce collection access controls unconditionally in client upload instruction routes via assertClientUploadAccess and prevent overrideAccess parameter injection.

Mitigation Strategies

• Upgrade Payload CMS core and all storage adapter plugins to version 3.90.0 or 4.0.0-canary.34 or later.
• Configure explicit adapter-level access control callbacks within the clientUploads.access option of @payloadcms/storage-vercel-blob.
• Deploy WAF rules to inspect incoming JSON payloads on /api/upload-instructions and block requests containing the overrideAccess property.

Remediation Steps:

1. Audit package.json and lockfiles (pnpm-lock.yaml, package-lock.json, or yarn.lock) to identify installations of payload between 3.25.0 and 3.89.x or 4.0.0-canary.0 and 4.0.0-canary.33.
2. Run pnpm update payload @payloadcms/storage-vercel-blob (and any other @payloadcms/storage-* packages) to upgrade to 3.90.0 or 4.0.0-canary.34.
3. Verify that custom storage adapter configurations implement appropriate collection-level create and update access control functions.
4. Review cloud storage bucket logs and contents (e.g., Vercel Blob or Cloudflare R2) for any unreferenced or unauthorized files uploaded prior to patching.

References

• CVE-2026-93363 Record (CVE.org)
• NVD - CVE-2026-93363
• GitHub Security Advisory GHSA-mc8m-rr6c-r5qr
• VulnCheck Security Advisory: Payload CMS @payloadcms/storage-vercel-blob Improper Access Control
• Payload CMS Fix Commit 47abe9bb5c444330dbfaa9a5bc2033337932270b
• Payload CMS Release v3.90.0
• Payload CMS GitHub Repository

Read the full report for CVE-2026-93363 on our website for more details including interactive diagrams and full exploit analysis.