CVE-2026-93363— Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
Quick assessment
Affected
payloadcms payload
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PayloadCMS 的 @payloadcms/storage-vercel-blob 存储适配器存在一个不正确的访问控制漏洞，允许经过身份验证的用户通过直接访问 client-upload 路由绕过集合级别的权限限制。攻击者可以通过 client-upload 端点上传文件，而无需具备所需的集合访问权限，从而绕过预期的访问控制机制。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| payloadcms | payload | 3.25.0< 3.90.0 |
affected |
4.0.0-canary.0< 4.0.0-canary.34 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93363
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
Source: CVE Program / CVE List V5
Vulnerability Description
The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| payloadcms | payload | 3.25.0 ~ 3.90.0 | - |
|
II. Public POCs for CVE-2026-93363
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93363
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-93363 (2)
IV. Related Vulnerabilities
Same product: payload
-
CVE-2026-34750
Payload has Insufficient Filename Validation in Client-Uploa -
CVE-2026-34749
Payload has a CSRF Protection Bypass in Authentication Flow -
CVE-2026-34748
@payloadcms/next has Stored XSS in Admin Panel -
CVE-2026-34747
Payload has an SQL Injection via Query Handling -
CVE-2026-34746
Payload has Authenticated SSRF via Upload Functionality
Same vendor: payloadcms
-
CVE-2026-11779
PayloadCMS 3.84.1 - Authenticated account lockout bypass thr -
CVE-2026-34750
Payload has Insufficient Filename Validation in Client-Uploa -
CVE-2026-34749
Payload has a CSRF Protection Bypass in Authentication Flow -
CVE-2026-34748
@payloadcms/next has Stored XSS in Admin Panel -
CVE-2026-34747
Payload has an SQL Injection via Query Handling
Same weakness: CWE-862
-
CVE-2026-101879
OpenClaw Windows Node before 2026.7.1-3 Missing Authorizatio -
CVE-2026-102375
WordPress Optimole plugin <= 4.2.14 - Broken Access Control -
CVE-2026-102397
WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broke -
CVE-2026-47493
NVIDIA vGPU驱动越权访问致代码执行漏洞 -
CVE-2026-47604
NVIDIA驱动缺失授权检查致信息泄露漏洞
V. Comments for CVE-2026-93363
No comments yet