Read the docs
TI-2026-68486 Aliases CVE-2026-105848GHSA-r9v2-gg2j-22q5

Insufficient access control in Payload's Stripe REST proxy

Priority LOW 30CWE-749Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Payload versions before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 are affected, including the @payloadcms/plugin-stripe package. Missing authorization (CWE-862) in the optional Stripe REST proxy lets an authenticated user perform Stripe operations that were not intended. Exploitation requires a low-privileged account that can reach the enabled proxy. No user interaction is needed, and the attack runs over the network.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00244 15th percentileScored 2026-11-07
Fix Fixed payload (payloadcms): 3.90.0, 4.0.0-canary.34plugin-stripe (@payloadcms): 3.90.0, 4.0.0-canary.34+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
payloadcmspayloadbefore 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.343.90.0, 4.0.0-canary.34Patch availableCNA
payloadcmsplugin-stripebefore 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.343.90.0, 4.0.0-canary.34Patch availableCNA
—@payloadcms/plugin-stripe (npm)before 3.90.03.90.0Patch availableGHSA-r9v2-gg2j-22q5
—@payloadcms/plugin-stripe (npm)4.0.0-canary.0 to before 4.0.0-canary.344.0.0-canary.34Patch availableGHSA-r9v2-gg2j-22q5
  • payload Vendorpayloadcms Affected before 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 3.90.0, 4.0.0-canary.34 Patch available CNA
  • plugin-stripe Vendorpayloadcms Affected before 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 3.90.0, 4.0.0-canary.34 Patch available CNA
  • @payloadcms/plugin-stripe (npm) Vendor— Affected before 3.90.0 Fixed in 3.90.0 Patch available GHSA-r9v2-gg2j-22q5
  • @payloadcms/plugin-stripe (npm) Vendor— Affected 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 4.0.0-canary.34 Patch available GHSA-r9v2-gg2j-22q5

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*before 3.90.0Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*4.0.0 canary0Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*4.0.0 canary1Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*4.0.0 canary10Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*4.0.0 canary11Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*4.0.0 canary12Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*4.0.0 canary13Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*4.0.0 canary14Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*4.0.0 canary15Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*4.0.0 canary16Vulnerablepayloadcms
  • cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* Versions before 3.90.0 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:* Versions 4.0.0 canary0 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:* Versions 4.0.0 canary1 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:* Versions 4.0.0 canary10 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:* Versions 4.0.0 canary11 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:* Versions 4.0.0 canary12 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:* Versions 4.0.0 canary13 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:* Versions 4.0.0 canary14 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:* Versions 4.0.0 canary15 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:* Versions 4.0.0 canary16 Vulnerable ·payloadcms
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*4.0.0 canary17Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*4.0.0 canary18Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*4.0.0 canary19Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*4.0.0 canary2Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*4.0.0 canary20Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*4.0.0 canary21Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*4.0.0 canary22Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*4.0.0 canary23Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*4.0.0 canary24Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*4.0.0 canary25Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*4.0.0 canary26Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*4.0.0 canary27Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*4.0.0 canary28Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*4.0.0 canary29Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*4.0.0 canary3Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*4.0.0 canary30Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*4.0.0 canary31Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*4.0.0 canary32Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*4.0.0 canary33Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*4.0.0 canary4Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*4.0.0 canary5Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*4.0.0 canary6Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*4.0.0 canary7Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*4.0.0 canary8Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*4.0.0 canary9Vulnerablepayloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:* Versions 4.0.0 canary17 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:* Versions 4.0.0 canary18 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:* Versions 4.0.0 canary19 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:* Versions 4.0.0 canary2 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:* Versions 4.0.0 canary20 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:* Versions 4.0.0 canary21 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:* Versions 4.0.0 canary22 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:* Versions 4.0.0 canary23 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:* Versions 4.0.0 canary24 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:* Versions 4.0.0 canary25 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:* Versions 4.0.0 canary26 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:* Versions 4.0.0 canary27 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:* Versions 4.0.0 canary28 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:* Versions 4.0.0 canary29 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:* Versions 4.0.0 canary3 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:* Versions 4.0.0 canary30 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:* Versions 4.0.0 canary31 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:* Versions 4.0.0 canary32 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:* Versions 4.0.0 canary33 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:* Versions 4.0.0 canary4 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:* Versions 4.0.0 canary5 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:* Versions 4.0.0 canary6 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:* Versions 4.0.0 canary7 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:* Versions 4.0.0 canary8 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:* Versions 4.0.0 canary9 Vulnerable ·payloadcms

Remediation

Upgrade @payloadcms/plugin-stripe to 3.90.0 or 4.0.0-canary.34. The sources list no fixed version for payload.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA payload (payloadcms) Fixed in 3.90.0, 4.0.0-canary.34
  • Fix · CNA plugin-stripe (@payloadcms) Fixed in 3.90.0, 4.0.0-canary.34
  • Fix · GHSA-r9v2-gg2j-22q5 @payloadcms/plugin-stripe (npm) Fixed in 3.90.0 Advisory →
  • Fix · GHSA-r9v2-gg2j-22q5 @payloadcms/plugin-stripe (npm) Fixed in 4.0.0-canary.34 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105848
  2. 2026-10-06 Alias added: GHSA-r9v2-gg2j-22q5
  3. 2026-10-06 Fix available: npm/@payloadcms/[email protected], npm/@payloadcms/[email protected] · GHSA-r9v2-gg2j-22q5
  4. 2026-10-06 CVSS score added · GHSA-r9v2-gg2j-22q5
  5. 2026-10-06 Weakness changed · GHSA-r9v2-gg2j-22q5
  6. 2026-10-06 4 new references · GHSA-r9v2-gg2j-22q5
  7. 2026-10-07 Priority changed: MEDIUM → LOW
  8. 2026-10-09 CISA SSVC decision points changed
  9. 2026-10-15 CVSS score added · NVD

References

Patch 2

Advisory 1

Other 1

  • TI-2026-20653 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68608 Payload CMS lets attackers update collection documents CVSS 3.1CRITICAL 9.8
  • TI-2026-68606 Remote code execution in Payload Form Builder plugin CVSS 3.1CRITICAL 10.0
  • TI-2026-68612 Payload authentication token field handling issue CVSS 4.0CRITICAL 9.2
  • TI-2026-26995 Payload has Unvalidated Input in Password Recovery Endpoints CVSS 3.1CRITICAL 9.1
  • TI-2026-68489 Field access control bypass in Payload duplicate operation CVSS 4.0CRITICAL 9.3
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences