GHSA-mc8m-rr6c-r5qr

Suggest an improvement
Source
https://github.com/advisories/GHSA-mc8m-rr6c-r5qr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-mc8m-rr6c-r5qr/GHSA-mc8m-rr6c-r5qr.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mc8m-rr6c-r5qr
Aliases
Published
2026-11-04T17:00:39Z
Modified
2026-11-04T17:15:11Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter
Details

Impact

In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.

You are affected if:

  • You use client uploads with @payloadcms/storage-vercel-blob.
  • Authenticated users can access the client-upload route.

Applications that do not enable client uploads are not affected.

Patches

Client uploads now require authentication and the appropriate collection-level access before upload access is granted.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-04T17:00:39Z",
    "nvd_published_at": "2026-09-25T17:17:19Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / @payloadcms/storage-vercel-blob

Package

Name
@payloadcms/storage-vercel-blob
View open source insights on deps.dev
Purl
pkg:npm/%40payloadcms/storage-vercel-blob

Affected ranges

Type
SEMVER
Events
Introduced
3.25.0
Fixed
3.90.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-mc8m-rr6c-r5qr/GHSA-mc8m-rr6c-r5qr.json"

npm / @payloadcms/storage-vercel-blob

Package

Name
@payloadcms/storage-vercel-blob
View open source insights on deps.dev
Purl
pkg:npm/%40payloadcms/storage-vercel-blob

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0-canary.0
Fixed
4.0.0-canary.34

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-mc8m-rr6c-r5qr/GHSA-mc8m-rr6c-r5qr.json"