CVE-2026-59965
Received Received - Intake

Authenticated User Access Bypass in Payload CMS Plugins

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while alt-text/src/endpoints/generateAltText.ts and alt-text/src/endpoints/bulkGenerateAltTexts.ts call req.payload.findByID and req.payload.update without overrideAccess: false. Payload therefore defaults overrideAccess to true and skips the target collection's read and update access functions. An authenticated low-privilege user can supply id, collection, locale, and update values to read arbitrary protected upload documents and overwrite their alt and keywords fields, even when the collection permits those operations only to administrators. A control Local API call with overrideAccess: false is denied, confirming that the plugin endpoint bypasses otherwise effective collection rules. This vulnerability is fixed in 0.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-59965
EUVD
EUVD-2026-78819

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
jhb.software payload-alt-text-plugin 0.7.0
jhb.software payload-alt-text-plugin to 0.8.0 (exc)
jhb.software payload-alt-text-plugin 0.8.0
payload_cms payload to 0.8.0 (exc)
payload_cms payload 0.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the @jhb.software/payload-alt-text-plugin version 0.7.0 or earlier. The plugin's custom endpoints (POST /api/alt-text-plugin/generate and /bulk) call Payload's Local API without setting overrideAccess to false. This causes Payload to default overrideAccess to true, bypassing collection-level access controls. Any authenticated user can exploit this to read or modify alt text and keywords fields of arbitrary upload documents in restricted collections.

Impact Analysis

An attacker with low privileges can read or overwrite protected fields in collections that should be restricted to administrators. This includes modifying alt text and keywords in upload documents, potentially leading to data leaks or unauthorized changes. The impact depends on the affected collections and their sensitivity.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating principles of least privilege and data integrity required by GDPR and HIPAA. Non-compliance risks include fines, legal penalties, and reputational damage due to unauthorized data exposure or tampering.

Mitigation Strategies
  • Upgrade the @jhb.software/payload-alt-text-plugin to version 0.8.0 or later to apply the security fixes.
  • Review and restrict access controls for all collections using the plugin to ensure only authorized users can read or modify alt text and keywords fields.
  • Monitor for unauthorized access attempts or modifications to protected document fields in collections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59965. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart