PT-2026-31018 · Unknown+1 · Payloadcms+1

Dag-Rui · Published 2026-04-07 · Updated 2026-04-09 · CVE-2026-39397

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @delmaredigital/payload-puck versions prior to 0.6.23

Description The @delmaredigital/payload-puck plugin for PayloadCMS, a visual page builder integration, had a critical issue where access control was bypassed. Specifically, all CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with overrideAccess: true, ignoring collection-level access controls. The access option passed to createPuckPlugin() and any access rules defined on Puck-registered collections were also ignored on these endpoints.

Recommendations Update to version 0.6.23 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-39397

GHSA-65W6-PF7X-5G85

Affected Products

@Delmaredigital/Payload-Puck

Payloadcms

References · 12

• 🔥 https://github.com/delmaredigital/payload-puck/issues/7 · Exploit
• https://github.com/delmaredigital/payload-puck/security/advisories/GHSA-65w6-pf7x-5g85 · Vendor Advisory
• https://github.com/delmaredigital/payload-puck/commit/9148201c6bbfa140d44546438027a2f8a70f79a4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39397 · Security Note
• https://osv.dev/vulnerability/GHSA-65w6-pf7x-5g85 · Vendor Advisory
• https://github.com/delmaredigital/payload-puck · Note
• https://twitter.com/0dayPublishing/status/2041616880213827824 · Twitter Post
• https://twitter.com/CVEnew/status/2041711882877464952 · Twitter Post
• https://twitter.com/vulert_official/status/2041889362187841615 · Twitter Post
• https://twitter.com/CveFindCom/status/2041632798344159632 · Twitter Post
• https://twitter.com/pulsepatchio/status/2042072048856658205 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041732207929086057 · Twitter Post