{"vulnerability": "ghsa-8r29-2mp2-pmrw", "sightings": [{"uuid": "97901730-2e32-40e5-b8f4-8ff466c88f92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8r29-2mp2-pmrw", "type": "seen", "source": "https://gist.github.com/alon710/053c345a4e98e24146f5e65d468ed9a0", "content": "# CVE-2026-105850: CVE-2026-105850: Race Condition and Order Double-Processing in @payloadcms/plugin-ecommerce\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105850\n\n## Summary\nA high-severity race condition vulnerability exists in @payloadcms/plugin-ecommerce within the Stripe payment adapter's order confirmation pipeline. Unauthenticated attackers or parallel webhook deliveries can exploit sequential, non-atomic database operations to bypass state verifications, leading to duplicate order creation, multiple inventory decrements, and inconsistent database records.\n\n## TL;DR\nSequential, non-atomic database operations in @payloadcms/plugin-ecommerce allow concurrent requests to bypass state verification checks, leading to duplicate order creation and inventory depletion.\n\n## Technical Details\n\n- **CWE ID**: CWE-837\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.8 (High)\n- **Impact**: High Integrity, High Availability (Duplicate Orders & Inventory Depletion)\n- **Exploit Status**: None (No public exploits in the wild)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- @payloadcms/plugin-ecommerce\n- payload\n- **@payloadcms/plugin-ecommerce**: < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade @payloadcms/plugin-ecommerce to version 3.90.0 or higher.\n- Generate and apply PostgreSQL database migrations to support the new transaction state.\n- Refactor custom payment adapters to use the centralized, atomic finalizeOrder callback.\n\n**Remediation Steps:**\n1. Verify the current installed version of @payloadcms/plugin-ecommerce in your package.json.\n2. Execute your package manager's upgrade command to fetch version 3.90.0 or later (or 4.0.0-canary.34 or later for the 4.x branch).\n3. Generate database migrations locally by executing: npx payload migrate\n4. Deploy and run the generated migration on staging and production database environments.\n5. Review any internal custom billing or Stripe webhooks to verify compatibility with the new API signature.\n\n## References\n\n- [GitHub Security Advisory GHSA-8r29-2mp2-pmrw](https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw)\n- [Official Fix Commit](https://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e)\n- [Payload CMS v3.90.0 Release Notes](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105850) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T21:30:30.000000Z"}]}