Executive brief
A security vulnerability in the payload-puck plugin for PayloadCMS allows unauthorized users to bypass security rules. This plugin is used to integrate a visual page builder into websites. Because of this flaw, an attacker could view, create, modify, or delete website pages and drafts without needing to log in, potentially leading to website defacement or data loss.
Technical details
A missing authorization vulnerability (CWE-862) exists in the @delmaredigital/payload-puck plugin prior to version 0.6.23. The CRUD endpoint handlers registered via createPuckPlugin() in 'src/endpoints/index.ts' invoked PayloadCMS's local API with 'overrideAccess: true' by default. This configuration caused the system to ignore all collection-level access control rules and the 'access' configuration passed to the plugin. An unauthenticated remote attacker can exploit this to perform create, read, update, and delete (CRUD) operations on any collection registered with the plugin (typically the 'pages' collection). The vulnerability is fixed in version 0.6.23 by setting 'overrideAccess: false' and properly forwarding the request object to ensure user permissions are evaluated.
Affected products
- delmaredigital payload-puck < 0.6.23
Timeline
- 2026-04-06: disclosed: Issue reported on GitHub
- 2026-04-06: patched: Fix committed to repository
- 2026-04-07: advisory: NVD and GitHub advisory published