PT-2026-6651 · Payloadcms · Pyload

S2Ongmo · Publicado 2026-02-05 · Atualizado 2026-02-09 · CVE-2026-25574

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.74.0

Description Payload is a headless content management system. A cross-collection Insecure Direct Object Reference (IDOR) exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. The vulnerability affects users if multiple auth collections are configured, a Postgres or SQLite database adapter with serial/auto-increment IDs is used, and users in different auth collections have the same numeric ID. The issue does not affect users utilizing the @payloadcms/db-mongodb adapter, single auth collection environments, or Postgres/SQLite with idType: 'uuid'.

Recommendations Upgrade to version 3.74.0 or later.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-25574

GHSA-JQ29-R496-R955

Produtos afetados

Pyload

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25574.json · Exploit
• https://github.com/payloadcms/payload · Nota
• https://github.com/payloadcms/payload/security/advisories/GHSA-jq29-r496-r955 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25574 · Nota de Segurança
• https://twitter.com/CVEnew/status/2019885530432041066 · Publicação no Twitter
• https://t.me/cveNotify/151436 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-jq29-r496-r955 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-25574 · Aviso do Fabricante