CVE-2026-93363 in Payload
Summary
by MITRE • 09/25/2026
The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The @payloadcms/storage-vercel-blob storage adapter for Payload CMS exhibits a critical improper access control vulnerability that undermines the integrity of its permission system. This flaw specifically affects authenticated users who can exploit direct HTTP requests to the client-upload route, thereby bypassing collection-level permissions entirely. In typical Content Management System architectures like Payload, fine-grained access controls are designed to restrict file uploads based on user roles and specific resource permissions. However, in this instance, the storage adapter fails to enforce these checks at the point of ingestion for files destined for Vercel Blob storage. This architectural gap allows any authenticated account, regardless of its assigned privileges within a given collection, to upload arbitrary content directly through the exposed endpoint.
From a technical perspective, the vulnerability stems from an insufficient validation mechanism in the client-upload handler associated with the VerceBlob adapter. While Payload CMS generally enforces permissions at the API layer for standard CRUD operations, this specific storage integration appears to operate outside or parallel to these checks during the file upload process. The system accepts the request and processes it without verifying whether the initiating user has write access to the target collection. This represents a classic case of broken object level authorization where the security context is not correctly propagated or validated against the resource being modified. Consequently, the intended separation between administrative users who manage content and standard contributors who may have limited upload rights is effectively nullified for this specific storage backend.
The operational impact of this vulnerability is significant as it allows attackers to bypass organizational data governance policies. An attacker with low-privilege access can potentially upload malicious files such as web shells, phishing assets, or other harmful payloads directly into the blob storage associated with a collection they are not authorized to modify. This could lead to remote code execution if the uploaded file is subsequently served and executed by an application server that trusts user-uploaded content without proper sanitization. Furthermore, it enables data exfiltration scenarios where sensitive documents can be stored in locations accessible via public URLs generated by the blob storage service, leading to unauthorized disclosure of confidential information. The ability to circumvent access controls also facilitates denial-of-service attacks through resource exhaustion if an attacker uploads large volumes of files rapidly.
To mitigate this risk, immediate action is required from both developers and system administrators using Payload CMS with the VerceBlob adapter. Developers should patch their installations by updating to a version where the client-upload route properly validates collection-level permissions before processing any file upload requests. This involves ensuring that the middleware or handler responsible for handling uploads invokes the same permission checking logic used in other API endpoints, verifying both user authentication and specific resource authorization against the target collection schema. System administrators should also implement network-level controls such as Web Application Firewalls to monitor and restrict direct access to storage-specific endpoints unless explicitly required by legitimate application workflows. Additionally, enforcing strict file type validation and size limits at the gateway level can provide an additional layer of defense against abuse even if the underlying permission check is bypassed temporarily until a patch is applied.
This vulnerability aligns with CWE-284 Improper Access Control as it involves unauthorized access to resources due to insufficient enforcement of security policies. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to gain initial access and then exploit privilege escalation or lateral movement capabilities by bypassing intended restrictions. The scenario reflects common pitfalls in modern web application development where modular components like storage adapters may not inherit the security context of the parent framework correctly. Addressing this requires a holistic review of how authentication tokens are passed through different layers of the application stack to ensure that every entry point, including file upload handlers, respects the defined role-based access control policies established by the system administrators.