CVE-2026-93363: CVE-2026-93363: Improper Access Control in Payload CMS Storage Upload Route
CVE-2026-93363: Improper Access Control in Payload CMS Storage Upload Route
> Vulnerability ID: CVE-2026-93363
> CVSS Score: 4.3
> Published: 2026-11-04
Payload CMS contains a missing authorization vulnerability (CWE-862) in its client-side upload instructions endpoint and the @payloadcms/storage-vercel-blob storage adapter. Two distinct logic defects allow authenticated users lacking collection-level create or update permissions to generate signed upload tokens and upload arbitrary files directly to external cloud storage.
TL;DR
Authenticated low-privileged users can bypass collection-level access controls in Payload CMS (versions 3.25.0 to < 3.90.0 and 4.0.0-canary.0 to < 4.0.0-canary.34) by directly querying /api/upload-instructions when using third-party storage adapters like @payloadcms/storage-vercel-blob, or by injecting overrideAccess: true into the JSON request body.
---
Technical Details
- Vulnerability Type: Missing Authorization (CWE-862)
- CVSS v3.1 Score: 4.3 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- CVSS v4.0 Score: 5.3 Medium (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N)
- EPSS Score: 0.18% (7.28th percentile)
- Attack Vector: Network via POST /api/upload-instructions
- Affected Versions: 3.25.0 to < 3.90.0; 4.0.0-canary.0 to < 4.0.0-canary.34
- Patched Versions: 3.90.0, 4.0.0-canary.34
- CISA KEV Status: Not Listed
Affected Systems
- Payload CMS (payload)
- Payload CMS Vercel Blob Storage Adapter (@payloadcms/storage-vercel-blob)
- Payload CMS Cloudflare R2 Storage Adapter (@payloadcms/storage-r2)
- payload / @payloadcms/storage-vercel-blob: >= 3.25.0, < 3.90.0 (Fixed in: 3.90.0)
- payload / @payloadcms/storage-vercel-blob: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: 4.0.0-canary.34)
Code Analysis
Commit: 47abe9b
Enforce collection access controls unconditionally in client upload instruction routes via assertClientUploadAccess and prevent overrideAccess parameter injection.
Mitigation Strategies
- Upgrade Payload CMS core and all storage adapter plugins to version 3.90.0 or 4.0.0-canary.34 or later.
- Configure explicit adapter-level access control callbacks within the clientUploads.access option of @payloadcms/storage-vercel-blob.
- Deploy WAF rules to inspect incoming JSON payloads on /api/upload-instructions and block requests containing the overrideAccess property.
Remediation Steps:
1. Audit package.json and lockfiles (pnpm-lock.yaml, package-lock.json, or yarn.lock) to identify installations of payload between 3.25.0 and 3.89.x or 4.0.0-canary.0 and 4.0.0-canary.33.
2. Run pnpm update payload @payloadcms/storage-vercel-blob (and any other @payloadcms/storage-* packages) to upgrade to 3.90.0 or 4.0.0-canary.34.
3. Verify that custom storage adapter configurations implement appropriate collection-level create and update access control functions.
4. Review cloud storage bucket logs and contents (e.g., Vercel Blob or Cloudflare R2) for any unreferenced or unauthorized files uploaded prior to patching.
References
- CVE-2026-93363 Record (CVE.org)
- NVD - CVE-2026-93363
- GitHub Security Advisory GHSA-mc8m-rr6c-r5qr
- VulnCheck Security Advisory: Payload CMS @payloadcms/storage-vercel-blob Improper Access Control
- Payload CMS Fix Commit 47abe9bb5c444330dbfaa9a5bc2033337932270b
- Payload CMS Release v3.90.0
- Payload CMS GitHub Repository
---
Read the full report for CVE-2026-93363 on our website for more details including interactive diagrams and full exploit analysis.
A CMS should fit your product architecture, not dictate it.
payload (~45k★): TypeScript CMS with developer-owned content models. payloadcms/payload
What would you build with a code-first CMS?
2 views
Repo link: payloadcms/payload
Runs 100% locally — nothing uploads. What paid tool should I replace next?
Stop Paying $180.00 for Sanity Growth — This Free GitHub Repo Replaces It
Sanity Growth costs $180.00 a year per user. Payload is free, open source, and runs entirely on your own machine.
Payload has 45,434 stars on GitHub and is licensed under MIT. Your data never leaves your own machine — nothing gets uploaded to anyone's cloud.
⭐ Repo: payloadcms/payload
🌐 Site: payloadcms.com
── SYSTEM REQUIREMENTS ──
Windows: Windows, macOS or Linux; new projects start with npx create-payload-app · Not stated in the installation docs · Node.js 20.18.1 or newer, pnpm, npm or yarn 2+, a supported Next.js version and a database
macOS: macOS, Windows or Linux; new projects start with npx create-payload-app · Not stated in the installation docs · Node.js 20.18.1 or newer, pnpm, npm or yarn 2+, a supported Next.js version and a database
── WHAT YOU GET ──
• ADMIN PANEL
• CONTENT MODELS IN CODE
• ACCESS CONTROL
• DRAFTS AND VERSIONS
• REST AND GRAPHQL
I post free open-source replacements for paid software every single day. If you're tired of subscriptions eating your budget, subscribe — there's a new one tomorrow.
Searching for: payload cms tutorial, payload cms self hosted, sanity alternative free, open source headless cms, payload vs sanity, nextjs cms
#Shorts #Payload #OpenSource #SelfHosted
Pricing shown is Sanity Growth plan, $15 per seat per month ($180 a year per user), checked 2026-10-22. Prices change — verify before you buy.
1 comment · 6 views
Build an Autonomous Web Research Analyst with Firecrawl, LangChain & M
This video demonstrates building an autonomous web research analyst by integrating Firecrawl CLI for data extraction, LangChain for AI reasoning, Payload for workflow orchestration, and Tremor for monitoring. We'll connect these tools to create a system that autonomously researches topics and delivers insights. The focus is on practical implementation rather than theoretical concepts. The final product handles end-to-end research workflows with minimal human intervention.
Repositories used in this architecture:
- firecrawl-cli: firecrawl/cli
- agents-towards-production: NirDiamant/agents-towards-production
- langchain: langchain-ai/langchain
- payload: payloadcms/payload
- tremor: tremorlabs/tremor
This episode explains one integrated product architecture, including interfaces, data flow, deployment, security, and failure handling.
Subscribe for daily open-source product builds: youtube.com
#GitHub #OpenSource #SoftwareArchitecture #Programming
8 views
了解到有一款比较流行的开源CMS框架，比WordPress更友好更灵活。有用这个的吗
github.com/payloadcms t.co
18 views
Building an admin panel from scratch again? 🧩
Payload gives TypeScript apps a headless CMS with an admin UI and content APIs. Handy for custom websites. 📝
payloadcms/payload
#CMS #浇朋友 #蓝朋友 #互关 #fo
1 like · 39 views
HEADLESS CMS THEO TRIẾT LÝ CODE-FIRST VÀ TÍCH HỢP NGUYÊN BẢN VỚI NEXT.JS: PAYLOAD CMS LÀ VŨ KHÍ TỐI THƯỢNG CỦA FULL-STACK DEV
Nhiều Headless CMS truyền thống thường buộc lập trình viên phải định nghĩa schema dữ liệu trên giao diện web, sau đó phải đồng bộ schema về mã nguồn và xử lý các vấn đề migration phức tạp. Hơn nữa, việc phải vận hành một máy chủ backend CMS tách rời hoàn toàn với ứng dụng web Next.js làm gia tăng chi phí hạ tầng.
Payload CMS là nền tảng quản trị nội dung mã nguồn mở thế hệ mới (Code-First TypeScript Headless CMS) có khả năng nhúng trực tiếp vào chính dự án Next.js của bạn mà không cần chạy máy chủ riêng.
Tech Stack:
Được xây dựng 100% bằng TypeScript hiện đại. Hỗ trợ cơ sở dữ liệu PostgreSQL, MongoDB hoặc SQLite thông qua các database adapter chính thức. Tích hợp sâu vào Next.js App Router.
Tại sao nên dùng?
- Triết lý Code-First thuần túy: Toàn bộ cấu trúc bảng dữ liệu, trường thông tin và phân quyền được định nghĩa hoàn toàn bằng code TypeScript. Bạn có thể tận dụng Git để review Pull Request và version control cấu trúc dữ liệu chặt chẽ.
- Tự động sinh TypeScript Types chuẩn xác: Mỗi khi bạn thay đổi cấu trúc trường trong file config, toàn bộ TypeScript types tương ứng được sinh lại tức thì, đảm bảo an toàn kiểu dữ liệu 100% từ backend sang frontend.
- Nhúng nguyên bản vào Next.js (Payload 3.0): Giao diện Admin và các API endpoint của CMS chạy chung trong cùng một tiến trình Next.js, giúp triển khai toàn bộ website và CMS lên Vercel hoặc VPS chỉ với một lệnh deploy duy nhất.
Dự án đã cán mốc hơn 30.000 stars trên GitHub và đang là sự lựa chọn nâng cấp hàng đầu của các agency và công ty công nghệ xây dựng web quy mô lớn.
Link tham khảo: payloadcms/payload
#OpenSourceVN #VNOSS #opensourcevn #vnoss #DevCommunity #PayloadCMS #NextJS #TypeScript #HeadlessCMS #WebDev #FullStack
1 point
📃 Full post: payloadcms.com
🚚 How to migrate: payloadcms.com
🧑💻 Releases:
github.com/payloadcms/payload/releases
3 likes · 518 views
@acandael @payloadcms It's coming. In the meantime: github.com/payloadcms/payload/releases
1 like · 11 views
Mentions
CVE-2026-93363: CVE-2026-93363: Improper Access Control in Payload CMS Storage Upload Route CVE-2026-93363: Improper Access Control in Payload CMS Storage Upload Route > Vulnerability ID: CVE-2026-93363 > CVSS Score: 4.3 > Published: 2026-11-04 Payload CMS contains a missing authorization vulnerability (CWE-862) in its client-side upload instructions endpoint and the @payloadcms/storage-vercel-blob storage adapter. Two distinct logic defects allow authenticated users lacking collection-level create or update permissions to generate signed upload tokens and upload arbitrary files directly to external cloud storage. TL;DR Authenticated low-privileged users can bypass collection-level access controls in Payload CMS (versions 3.25.0 to < 3.90.0 and 4.0.0-canary.0 to < 4.0.0-canary.34) by directly querying /api/upload-instructions when using third-party storage adapters like @payloadcms/storage-vercel-blob, or by injecting overrideAccess: true into the JSON request body. --- Technical Details - Vulnerability Type: Missing Authorization (CWE-862) - CVSS v3.1 Score: 4.3 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - CVSS v4.0 Score: 5.3 Medium (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) - EPSS Score: 0.18% (7.28th percentile) - Attack Vector: Network via POST /api/upload-instructions - Affected Versions: 3.25.0 to < 3.90.0; 4.0.0-canary.0 to < 4.0.0-canary.34 - Patched Versions: 3.90.0, 4.0.0-canary.34 - CISA KEV Status: Not Listed Affected Systems - Payload CMS (payload) - Payload CMS Vercel Blob Storage Adapter (@payloadcms/storage-vercel-blob) - Payload CMS Cloudflare R2 Storage Adapter (@payloadcms/storage-r2) - payload / @payloadcms/storage-vercel-blob: >= 3.25.0, < 3.90.0 (Fixed in: 3.90.0) - payload / @payloadcms/storage-vercel-blob: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: 4.0.0-canary.34) Code Analysis Commit: 47abe9b Enforce collection access controls unconditionally in client upload instruction routes via assertClientUploadAccess and prevent overrideAccess parameter injection. Mitigation Strategies - Upgrade Payload CMS core and all storage adapter plugins to version 3.90.0 or 4.0.0-canary.34 or later. - Configure explicit adapter-level access control callbacks within the clientUploads.access option of @payloadcms/storage-vercel-blob. - Deploy WAF rules to inspect incoming JSON payloads on /api/upload-instructions and block requests containing the overrideAccess property. Remediation Steps: 1. Audit package.json and lockfiles (pnpm-lock.yaml, package-lock.json, or yarn.lock) to identify installations of payload between 3.25.0 and 3.89.x or 4.0.0-canary.0 and 4.0.0-canary.33. 2. Run pnpm update payload @payloadcms/storage-vercel-blob (and any other @payloadcms/storage-* packages) to upgrade to 3.90.0 or 4.0.0-canary.34. 3. Verify that custom storage adapter configurations implement appropriate collection-level create and update access control functions. 4. Review cloud storage bucket logs and contents (e.g., Vercel Blob or Cloudflare R2) for any unreferenced or unauthorized files uploaded prior to patching. References - CVE-2026-93363 Record (CVE.org) - NVD - CVE-2026-93363 - GitHub Security Advisory GHSA-mc8m-rr6c-r5qr - VulnCheck Security Advisory: Payload CMS @payloadcms/storage-vercel-blob Improper Access Control - Payload CMS Fix Commit 47abe9bb5c444330dbfaa9a5bc2033337932270b - Payload CMS Release v3.90.0 - Payload CMS GitHub Repository --- Read the full report for CVE-2026-93363 on our website for more details including interactive diagrams and full exploit analysis.
A CMS should fit your product architecture, not dictate it. payload (~45k★): TypeScript CMS with developer-owned content models. payloadcms/payload What would you build with a code-first CMS?
Repo link: payloadcms/payload Runs 100% locally — nothing uploads. What paid tool should I replace next?
Stop Paying $180.00 for Sanity Growth — This Free GitHub Repo Replaces It Sanity Growth costs $180.00 a year per user. Payload is free, open source, and runs entirely on your own machine. Payload has 45,434 stars on GitHub and is licensed under MIT. Your data never leaves your own machine — nothing gets uploaded to anyone's cloud. ⭐ Repo: payloadcms/payload 🌐 Site: payloadcms.com ── SYSTEM REQUIREMENTS ── Windows: Windows, macOS or Linux; new projects start with npx create-payload-app · Not stated in the installation docs · Node.js 20.18.1 or newer, pnpm, npm or yarn 2+, a supported Next.js version and a database macOS: macOS, Windows or Linux; new projects start with npx create-payload-app · Not stated in the installation docs · Node.js 20.18.1 or newer, pnpm, npm or yarn 2+, a supported Next.js version and a database ── WHAT YOU GET ── • ADMIN PANEL • CONTENT MODELS IN CODE • ACCESS CONTROL • DRAFTS AND VERSIONS • REST AND GRAPHQL I post free open-source replacements for paid software every single day. If you're tired of subscriptions eating your budget, subscribe — there's a new one tomorrow. Searching for: payload cms tutorial, payload cms self hosted, sanity alternative free, open source headless cms, payload vs sanity, nextjs cms #Shorts #Payload #OpenSource #SelfHosted Pricing shown is Sanity Growth plan, $15 per seat per month ($180 a year per user), checked 2026-10-22. Prices change — verify before you buy.
Build an Autonomous Web Research Analyst with Firecrawl, LangChain & M This video demonstrates building an autonomous web research analyst by integrating Firecrawl CLI for data extraction, LangChain for AI reasoning, Payload for workflow orchestration, and Tremor for monitoring. We'll connect these tools to create a system that autonomously researches topics and delivers insights. The focus is on practical implementation rather than theoretical concepts. The final product handles end-to-end research workflows with minimal human intervention. Repositories used in this architecture: - firecrawl-cli: firecrawl/cli - agents-towards-production: NirDiamant/agents-towards-production - langchain: langchain-ai/langchain - payload: payloadcms/payload - tremor: tremorlabs/tremor This episode explains one integrated product architecture, including interfaces, data flow, deployment, security, and failure handling. Subscribe for daily open-source product builds: youtube.com #GitHub #OpenSource #SoftwareArchitecture #Programming
了解到有一款比较流行的开源CMS框架，比WordPress更友好更灵活。有用这个的吗 github.com/payloadcms t.co
Building an admin panel from scratch again? 🧩 Payload gives TypeScript apps a headless CMS with an admin UI and content APIs. Handy for custom websites. 📝 payloadcms/payload #CMS #浇朋友 #蓝朋友 #互关 #fo
HEADLESS CMS THEO TRIẾT LÝ CODE-FIRST VÀ TÍCH HỢP NGUYÊN BẢN VỚI NEXT.JS: PAYLOAD CMS LÀ VŨ KHÍ TỐI THƯỢNG CỦA FULL-STACK DEV Nhiều Headless CMS truyền thống thường buộc lập trình viên phải định nghĩa schema dữ liệu trên giao diện web, sau đó phải đồng bộ schema về mã nguồn và xử lý các vấn đề migration phức tạp. Hơn nữa, việc phải vận hành một máy chủ backend CMS tách rời hoàn toàn với ứng dụng web Next.js làm gia tăng chi phí hạ tầng. Payload CMS là nền tảng quản trị nội dung mã nguồn mở thế hệ mới (Code-First TypeScript Headless CMS) có khả năng nhúng trực tiếp vào chính dự án Next.js của bạn mà không cần chạy máy chủ riêng. Tech Stack: Được xây dựng 100% bằng TypeScript hiện đại. Hỗ trợ cơ sở dữ liệu PostgreSQL, MongoDB hoặc SQLite thông qua các database adapter chính thức. Tích hợp sâu vào Next.js App Router. Tại sao nên dùng? - Triết lý Code-First thuần túy: Toàn bộ cấu trúc bảng dữ liệu, trường thông tin và phân quyền được định nghĩa hoàn toàn bằng code TypeScript. Bạn có thể tận dụng Git để review Pull Request và version control cấu trúc dữ liệu chặt chẽ. - Tự động sinh TypeScript Types chuẩn xác: Mỗi khi bạn thay đổi cấu trúc trường trong file config, toàn bộ TypeScript types tương ứng được sinh lại tức thì, đảm bảo an toàn kiểu dữ liệu 100% từ backend sang frontend. - Nhúng nguyên bản vào Next.js (Payload 3.0): Giao diện Admin và các API endpoint của CMS chạy chung trong cùng một tiến trình Next.js, giúp triển khai toàn bộ website và CMS lên Vercel hoặc VPS chỉ với một lệnh deploy duy nhất. Dự án đã cán mốc hơn 30.000 stars trên GitHub và đang là sự lựa chọn nâng cấp hàng đầu của các agency và công ty công nghệ xây dựng web quy mô lớn. Link tham khảo: payloadcms/payload #OpenSourceVN #VNOSS #opensourcevn #vnoss #DevCommunity #PayloadCMS #NextJS #TypeScript #HeadlessCMS #WebDev #FullStack
📃 Full post: payloadcms.com 🚚 How to migrate: payloadcms.com 🧑💻 Releases: github.com/payloadcms/payload/releases
@acandael @payloadcms It's coming. In the meantime: github.com/payloadcms/payload/releases