CVE-2026-93363

Name of the Vulnerable Software and Affected Versions @payloadcms/storage-vercel-blob (affected versions not specified)

Description Improper access control in the storage adapter allows authenticated users to bypass collection-level permissions. By directly accessing the 'client-upload' endpoint, attackers can upload files without the necessary collection access permissions, circumventing intended security enforcement.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.