https://vulnerability.circl.lu/sightings/feed 2026-10-07T23:54:18.501795+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/9310f7b9-37a2-41a9-90ba-07ddbdc97b63/export 2026-10-07T23:54:18.559008+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9310f7b9-37a2-41a9-90ba-07ddbdc97b63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105848", "type": "seen", "source": "https://gist.github.com/alon710/9651c4081baa9d7f6be20d4b27a39a0d", "content": "# CVE-2026-105848: CVE-2026-105848: Insufficient Access Control in Payload CMS Stripe REST Proxy\n\n> **CVSS Score:** 6.4\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105848\n\n## Summary\nAn access control vulnerability in `@payloadcms/plugin-stripe` allows authenticated low-privilege users to bypass authorization boundaries and execute arbitrary, highly privileged operations on the connected Stripe platform via an exposed REST proxy.\n\n## TL;DR\nThe Payload CMS Stripe plugin REST proxy failed to validate user roles or restrict executable SDK methods. This allowed any standard authenticated user to issue refunds, alter billing models, or exfiltrate customer metadata using the server's master Stripe Secret Key.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-749, CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 6.4 (Medium)\n- **Exploit Status**: Proof-of-Concept / Easy to reproduce\n- **CISA KEV Status**: Not Listed\n- **Vulnerability Type**: Missing Authorization in Stripe REST Proxy\n\n## Affected Systems\n\n- @payloadcms/plugin-stripe\n- **@payloadcms/plugin-stripe**: < 3.90.0 (Fixed in: `3.90.0`)\n- **@payloadcms/plugin-stripe (canary)**: < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade @payloadcms/plugin-stripe to version 3.90.0 or higher.\n- Upgrade to version 4.0.0-canary.34 or higher if utilizing the 4.x canary branch.\n- Refactor plugin configurations to replace boolean 'rest: true' flags with structured objects enforcing explicit method allowlists and custom RBAC functions.\n- Disable the REST proxy entirely if client-side Stripe integrations are not strictly required.\n\n**Remediation Steps:**\n1. Identify deployments utilizing @payloadcms/plugin-stripe in the codebase.\n2. Check package.json to verify if the active version is below 3.90.0 or below 4.0.0-canary.34.\n3. Run 'npm install @payloadcms/plugin-stripe@latest' or 'yarn upgrade' to fetch the secure versions.\n4. Open the Payload CMS configuration file (typically payload.config.ts).\n5. Locate the stripePlugin() initialization block.\n6. If 'rest: true' is configured, modify it to use the new object format containing 'allowedMethods' and an explicit administrative 'access' callback.\n7. Verify the deployment by sending a test POST request with an unlisted method to confirm a 400 or 403 response is returned.\n\n## References\n\n- [Payload CMS Stripe REST Proxy Authorization Bypass Security Advisory](https://github.com/payloadcms/payload/security/advisories/GHSA-r9v2-gg2j-22q5)\n- [GitHub Security Commit 2f94a42](https://github.com/payloadcms/payload/commit/2f94a4205e5ba3ec0e91c92ed54f24f429826dd0)\n- [Payload Release Notes v3.90.0](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105848) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T01:30:31.000000Z"} 2026-10-07T01:30:31+00:00