Vulnerability GHSA-mc8m-rr6c-r5qr

Impact

In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.

You are affected if:

• You use client uploads with @payloadcms/storage-vercel-blob.
• Authenticated users can access the client-upload route.

Applications that do not enable client uploads are not affected.

Patches

Client uploads now require authentication and the appropriate collection-level access before upload access is granted.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.