GitHub Advisoryadvisory · npm

GHSA-r9v2-gg2j-22q5 Payload: Insufficient Access Control in Stripe REST Proxy

MEDIUM Published 2026-10-06 Modified 2026-10-06 Official page ↗
Aliases
CVE-2026-105848
Ecosystem
npm
Packages
@payloadcms/plugin-stripe
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weaknesses
CWE-749, CWE-862
Reviewed
2026-10-06

Affected packages

• npm @payloadcms/plugin-stripe: < 3.90.0 → fixed in 3.90.0 • npm @payloadcms/plugin-stripe: >= 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34

Description

Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. You are affected if ALL of these are true: • Your application uses `@payloadcms/plugin-stripe`. • The optional Stripe REST proxy is enabled. • An authenticated user can reach the proxy. Deployments that do not enable the Stripe REST proxy are not affected. Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. Workarounds Upgrading to a patched version is recommended. If you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.

Related

Alias · CVE (1)

  • CVE-2026-105848 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (2)

  • CWE-749 Exposed Dangerous Method or Function weakness
  • CWE-862 Missing Authorization weakness

References