fkie_cve-2026-105848

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

GHSA-r9v2-gg2j-22q5 — Payload: Insufficient Access Control in Stripe REST Proxy

Affected: npm: @payloadcms/plugin-stripe

## Impact

An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy.

**You are affected if ALL of these are true:**

- Your application uses `@payloadcms/plugin-stripe`. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy.

Deployments that do not enable the Stripe REST proxy are not affected.

## Patches

Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

## Workarounds

Upgrading to a patched version is recommended.

If you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.

Most recent entries from all

fkie_cve-2026-105848

GHSA-r9v2-gg2j-22q5 — Payload: Insufficient Access Control in Stripe REST Proxy