CVE-2026-93363
Last modified
CVE-2026-93363 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement..
Description
The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissions, circumventing the intended access control enforcement.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| payloadcms | payload | >= 3.25.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-93363?
How severe is CVE-2026-93363?
How do I fix CVE-2026-93363?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-93349Frictionless through 5.20.0rc1 contains an OS command inject…8.8
- CVE-2026-9335A vulnerability in keras-team/keras versions <= 3.14.0 allow…6.5
- CVE-2026-93352Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete p…9.8
- CVE-2026-93353copyparty contains a volume restriction bypass vulnerability…5.3
- CVE-2026-93354Taskview Community before 1.56.0 contains a missing authenti…8.1
- CVE-2026-9336IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …7.5
- CVE-2026-93364Bludit CMS through 3.22.0 contains a mass assignment vulnera…4.3
- CVE-2026-93365Bludit CMS through 3.22.0 contains a missing authorization v…6.5
- CVE-2026-93366Bludit CMS through 3.22.0 contains an authorization bypass v…5.4
- CVE-2026-93368The Rename wp-login.php to anything you want plugin for Word…7.5
- CVE-2026-93371A security vulnerability has been detected in marcopiovanell…8.3
- CVE-2026-93372Buffer overflow in WebGL in Google Chrome on on Android prio…9.6
Are you affected by CVE-2026-93363?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST