CVE-2026-59965

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59965
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59965.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59965
Aliases
Published
2026-09-15T15:56:32Z
Modified
2026-10-02T03:30:48Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N CVSS Calculator
Summary
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
Details

Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while alt-text/src/endpoints/generateAltText.ts and alt-text/src/endpoints/bulkGenerateAltTexts.ts call req.payload.findByID and req.payload.update without overrideAccess: false. Payload therefore defaults overrideAccess to true and skips the target collection's read and update access functions. An authenticated low-privilege user can supply id, collection, locale, and update values to read arbitrary protected upload documents and overwrite their alt and keywords fields, even when the collection permits those operations only to administrators. A control Local API call with overrideAccess: false is denied, confirming that the plugin endpoint bypasses otherwise effective collection rules. This vulnerability is fixed in 0.8.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59965.json"
}
References

Affected packages

Git / github.com/jhb-software/payload-plugins

Affected ranges

Type
GIT
Repo
https://github.com/jhb-software/payload-plugins
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e39634868ce13a414e2981e219befc58101654d3
Fixed
f239775697ec16eab18ef2aad056727b20122cf5
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.8.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

admin-search@0.*
admin-search@0.3.0
alt-text@0.*
alt-text@0.4.0
alt-text@0.4.1
alt-text@0.4.2
alt-text@0.4.3
alt-text@0.4.4
alt-text@0.5.0
alt-text@0.6.0
alt-text@0.6.1
alt-text@0.7.0
chat-agent@0.*
chat-agent@0.1.0-beta.2
chat-agent@0.1.0-beta.3
chat-agent@0.1.0-beta.4
chat-agent@0.1.0-beta.5
chat-agent@0.1.0-beta.6
chat-agent@0.1.0-beta.7
chat-agent@0.1.0-beta.8
cloudinary@0.*
cloudinary@0.3.4
cloudinary@0.4.0
content-translator@0.*
content-translator@0.2.0
geocoding@0.*
geocoding@0.2.2
pages@0.*
pages@0.7.0
pages@0.8.0
vercel-deployments@0.*
vercel-deployments@0.2.0
vercel-deployments@0.3.0
vercel-deployments@0.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59965.json"