CVE-2026-105850
Received Received - Intake

Stripe Payment Replay in Payload CMS

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description
Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-105850
EUVD
EUVD-2026-93493

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
payloadcms payload < 3.90.0
payloadcms payload >= 4.0.0-canary.0, < 4.0.0-canary.34
@payloadcms plugin-ecommerce < 3.90.0
@payloadcms plugin-ecommerce >= 4.0.0-canary.0, < 4.0.0-canary.34

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-837 The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Payload, a free and open source headless content management system. It specifically impacts the @payloadcms/plugin-ecommerce plugin versions before 3.90.0 and canary versions before 4.0.0-canary.34. The issue allows a Stripe order confirmation to be processed more than once under certain conditions due to improper handling in the Stripe payment adapter.

Impact Analysis

If you use the affected versions of the @payloadcms/plugin-ecommerce plugin with Stripe payment integration, an attacker could exploit this flaw to process the same order multiple times. This could lead to financial losses, incorrect order records, and potential disputes with customers or payment processors.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by potentially exposing financial data to unauthorized processing. GDPR requires accurate data handling and user consent, while HIPAA mandates secure and accurate transaction records. Duplicate processing could violate these requirements.

Mitigation Strategies

Update @payloadcms/plugin-ecommerce to version 3.90.0 or later for stable releases, or to version 4.0.0-canary.34 or later for canary releases. This addresses the Stripe order confirmation processing issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart