Read the docs
TI-2026-20681 Aliases CVE-2026-25574GHSA-jq29-r496-r955

Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)

Priority LOW 24CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. This vulnerability has been patched in v3.74.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Fix Fixed payload (payloadcms): 3.74.0payload (npm): 3.74.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
payloadcmspayloadbefore 3.74.03.74.0Patch availableCNA
—payload (npm)before 3.74.03.74.0Patch availableGHSA-jq29-r496-r955
  • payload Vendorpayloadcms Affected before 3.74.0 Fixed in 3.74.0 Patch available CNA
  • payload (npm) Vendor— Affected before 3.74.0 Fixed in 3.74.0 Patch available GHSA-jq29-r496-r955

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*before 3.74.0Vulnerablepayloadcms
  • cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* Versions before 3.74.0 Vulnerable ·payloadcms

Remediation

  • Fix · CNA payload (payloadcms) Fixed in 3.74.0
  • Fix · GHSA-jq29-r496-r955 payload (npm) Fixed in 3.74.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25574
  2. 2026-10-03 Alias added: GHSA-jq29-r496-r955

References

Advisory 2

Other 1

  • TI-2026-20653 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68608 Payload CMS lets attackers update collection documents CVSS 3.1CRITICAL 9.8
  • TI-2026-68606 Remote code execution in Payload Form Builder plugin CVSS 3.1CRITICAL 10.0
  • TI-2026-68612 Payload authentication token field handling issue CVSS 4.0CRITICAL 9.2
  • TI-2026-26995 Payload has Unvalidated Input in Password Recovery Endpoints CVSS 3.1CRITICAL 9.1
  • TI-2026-68489 Field access control bypass in Payload duplicate operation CVSS 4.0CRITICAL 9.3
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences