Executive brief
The payload-alt-text-plugin for Payload CMS fails to restrict access control when reading and updating document metadata. Any authenticated user—regardless of their role—can use two plugin endpoints to read and modify protected upload documents by exploiting an omitted access-control parameter that silently defaults to unsafe. This bypasses the role-based access rules that administrators configure on collections, allowing unauthorized users to modify sensitive metadata like alt text and keywords on files they should not have access to.
Technical details
The vulnerability is an incorrect authorization flaw (CWE-863) in the POST /api/alt-text-plugin/generate and /bulk endpoints. The plugin handler accepts user-controlled parameters (id, collection, locale, update) and passes them to Payload's Local API methods findByID() and update() without setting overrideAccess: false. Payload's default behavior is shouldOverrideAccess = overrideAccess !== false, meaning an undefined parameter evaluates to true, silently bypassing all collection-level access control functions. An attacker with any valid session (any role) can read arbitrary documents and overwrite the alt and keywords fields, regardless of the collection's configured access restrictions. The vulnerability affects versions before 0.8.0 and requires only network access and a valid authenticated session; no privilege escalation or additional preconditions are needed.
Affected products
- jhb.software payload-alt-text-plugin < 0.8.0
Timeline
- 2026-06-21: disclosed: GitHub advisory published
- 2026-09-10: advisory: GHSA-4qpv-39hg-f7fx issued
- 2026-09-16: patched: Patch version 0.8.0 released