CVE-2026-39397
A flaw in the delmaredigital/payload-puck plugin for PayloadCMS lets attackers bypass all collection‑level access controls on its CRUD API endpoints. This means anyone who can reach those endpoints can read or modify any data stored in the site’s collections.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
The delmaredigital/payload-puck plugin for PayloadCMS, versions earlier than 0.6.23.
Real-world impact
An attacker who can reach the vulnerable API endpoints could read sensitive data, alter content, or delete records in the CMS, potentially compromising the integrity and confidentiality of the website’s information.
Why this severity
The CVSS score of 9.4 reflects that the vulnerability can be exploited over the network with no authentication or user interaction, and it grants full confidentiality and integrity compromise while only partially affecting availability.
What to do about it
- 01Upgrade the delmaredigital/payload-puck plugin to version 0.6.23 or later.
NVD-referenced vendor advisory
Timeline
- Apr 7, 2026 · Apr 7, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/delmaredigital/payload-puck…patch
- github.com/delmaredigital/payload-puck…exploitissue tracking
- github.com/delmaredigital/payload-puck…patchvendor advisory