PT-2026-6651 · Payloadcms · Pyload

S2Ongmo · Published 2026-02-05 · Updated 2026-02-09 · CVE-2026-25574

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.74.0

Description Payload is a headless content management system. A cross-collection Insecure Direct Object Reference (IDOR) exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. The vulnerability affects users if multiple auth collections are configured, a Postgres or SQLite database adapter with serial/auto-increment IDs is used, and users in different auth collections have the same numeric ID. The issue does not affect users utilizing the @payloadcms/db-mongodb adapter, single auth collection environments, or Postgres/SQLite with idType: 'uuid'.

Recommendations Upgrade to version 3.74.0 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-25574

GHSA-JQ29-R496-R955

Affected Products

Pyload

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25574.json · Exploit
• https://github.com/payloadcms/payload/security/advisories/GHSA-jq29-r496-r955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25574 · Security Note
• https://osv.dev/vulnerability/GHSA-jq29-r496-r955 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25574 · Vendor Advisory
• https://github.com/payloadcms/payload · Note
• https://twitter.com/CVEnew/status/2019885530432041066 · Twitter Post
• https://t.me/cveNotify/151436 · Telegram Post