GHSA-r9v2-gg2j-22q5

Source

https://github.com/advisories/GHSA-r9v2-gg2j-22q5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-r9v2-gg2j-22q5/GHSA-r9v2-gg2j-22q5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r9v2-gg2j-22q5

Aliases

CVE-2026-105848

Published

2026-10-06T16:09:46Z

Modified

2026-10-06T16:15:05Z

Severity

6.4 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

Payload: Insufficient Access Control in Stripe REST Proxy

Details

Impact

An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy.

You are affected if ALL of these are true:

Your application uses @payloadcms/plugin-stripe.
The optional Stripe REST proxy is enabled.
An authenticated user can reach the proxy.

Deployments that do not enable the Stripe REST proxy are not affected.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Upgrading to a patched version is recommended.

If you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.

Database specific

{
    "cwe_ids":  [
        "CWE-749",
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-06T16:09:46Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / @payloadcms/plugin-stripe

Package

Name: @payloadcms/plugin-stripe; View open source insights on deps.dev
Purl: pkg:npm/%40payloadcms/plugin-stripe

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.90.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-r9v2-gg2j-22q5/GHSA-r9v2-gg2j-22q5.json"

npm / @payloadcms/plugin-stripe

Package

Name: @payloadcms/plugin-stripe; View open source insights on deps.dev
Purl: pkg:npm/%40payloadcms/plugin-stripe

Affected ranges

Type: SEMVER
Events: Introduced

4.0.0-canary.0

Fixed

4.0.0-canary.34

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-r9v2-gg2j-22q5/GHSA-r9v2-gg2j-22q5.json"