@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter

Impact

In affected configurations, client upload access does not consistently align with the associated collection’s access configuration.

You are affected if:

• You use client uploads with @payloadcms/storage-vercel-blob.
• Authenticated users can access the client-upload route.

Applications that do not enable client uploads are not affected.

Patches

Client uploads now require authentication and the appropriate collection-level access before upload access is granted.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Upgrading to a patched version is recommended. Until you can upgrade, disable client uploads or configure the upload route’s access control to enforce the associated collection’s permissions.