CVE-2026-39397
Access Control Bypass in @delmaredigital/payload-puck Plugin Endpoints
Publication date: 2026-04-07
Last updated on: 2026-04-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| delmaredigital | payload-puck | to 0.6.23 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the @delmaredigital/payload-puck plugin to version 0.6.23 or later, where the issue is fixed.
Can you explain this vulnerability to me?
The vulnerability exists in the @delmaredigital/payload-puck plugin for PayloadCMS, specifically in versions prior to 0.6.23. The plugin's /api/puck/* CRUD endpoints called Payload's local API with the overrideAccess option set to true by default. This setting bypassed all collection-level access controls, meaning that access restrictions defined on collections or passed to the plugin were ignored. As a result, unauthorized users could perform create, read, update, or delete operations on data without proper permission checks.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows unauthorized users to bypass access controls and perform CRUD operations on data collections. This can lead to unauthorized data exposure, modification, or deletion. The CVSS score of 9.4 indicates a high severity, with potential for complete confidentiality, integrity, and partial availability loss.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows bypassing all collection-level access control in the PayloadCMS plugin, which means unauthorized users could access, modify, or delete sensitive data through the /api/puck/* CRUD endpoints.
Such unauthorized access and potential data breaches can lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive personal and health information.