Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
PayloadCMS plugin for Puck visual page builder insecurely bypasses access controls
CVE-2026-39397
GHSA-65w6-pf7x-5g85
Summary
A flaw in the @delmaredigital/payload-puck plugin for PayloadCMS allows unauthorized access to certain features of the Puck visual page builder. This means that an attacker could potentially access or modify sensitive parts of the site without proper authorization. Update to version 0.6.23 or later to fix this issue.
What to do
- Update delmaredigital payload-puck to version 0.6.23.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| delmaredigital | payload-puck | <= 0.6.23 | 0.6.23 |
Original title
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
Original description
### Impact
All `/api/puck/*` CRUD endpoint handlers registered by `createPuckPlugin()` called Payload's local API with the default `overrideAccess: true`, bypassing all collection-level access control. The `access` option passed to `createPuckPlugin()` and any `access` rules defined on Puck-registered collections were silently ignored on these endpoints.
An unauthenticated remote attacker could:
- List all documents (including drafts) in any Puck-registered collection
- Read any document by ID (including drafts)
- Create new documents with arbitrary field values
- Update any document (including bypassing field-level access rules)
- Delete any document
- Read version history and restore arbitrary versions
**In typical installations**, the affected scope is the collection backing the website's pages (default slug: `pages`). For most users this means an attacker could read, modify, create, or delete every page on the website — including unpublished drafts and version history.
**Scope is limited to collections explicitly registered with `createPuckPlugin()`** — the endpoints validate the collection slug against an allowlist, so attackers cannot pivot to other Payload collections such as `users`, `media`, or business data not exposed to the plugin. The auto-created `puck-templates`, `puck-ai-prompts`, and `puck-ai-context` collections are also outside the allowlist; they have their own dedicated endpoints with separate authentication.
Other endpoints in the plugin (AI, styles, prompts, context, and the Next.js API route factories in `src/api/`) were unaffected — they had their own authentication checks.
### Patches
Fixed in **0.6.23**. All endpoint handlers in `src/endpoints/index.ts` now pass `overrideAccess: false` and forward `req` to Payload's local API, so collection-level access rules are evaluated against the current user.
### Workarounds
If you cannot upgrade immediately, place a reverse-proxy or middleware authentication check in front of `/api/puck/*` to require an authenticated session before requests reach the plugin's handlers.
All `/api/puck/*` CRUD endpoint handlers registered by `createPuckPlugin()` called Payload's local API with the default `overrideAccess: true`, bypassing all collection-level access control. The `access` option passed to `createPuckPlugin()` and any `access` rules defined on Puck-registered collections were silently ignored on these endpoints.
An unauthenticated remote attacker could:
- List all documents (including drafts) in any Puck-registered collection
- Read any document by ID (including drafts)
- Create new documents with arbitrary field values
- Update any document (including bypassing field-level access rules)
- Delete any document
- Read version history and restore arbitrary versions
**In typical installations**, the affected scope is the collection backing the website's pages (default slug: `pages`). For most users this means an attacker could read, modify, create, or delete every page on the website — including unpublished drafts and version history.
**Scope is limited to collections explicitly registered with `createPuckPlugin()`** — the endpoints validate the collection slug against an allowlist, so attackers cannot pivot to other Payload collections such as `users`, `media`, or business data not exposed to the plugin. The auto-created `puck-templates`, `puck-ai-prompts`, and `puck-ai-context` collections are also outside the allowlist; they have their own dedicated endpoints with separate authentication.
Other endpoints in the plugin (AI, styles, prompts, context, and the Next.js API route factories in `src/api/`) were unaffected — they had their own authentication checks.
### Patches
Fixed in **0.6.23**. All endpoint handlers in `src/endpoints/index.ts` now pass `overrideAccess: false` and forward `req` to Payload's local API, so collection-level access rules are evaluated against the current user.
### Workarounds
If you cannot upgrade immediately, place a reverse-proxy or middleware authentication check in front of `/api/puck/*` to require an authenticated session before requests reach the plugin's handlers.
nvd CVSS3.1
9.4
Vulnerability type
CWE-862
Missing Authorization
- https://github.com/delmaredigital/payload-puck/commit/9148201c6bbfa140d445464380...
- https://github.com/delmaredigital/payload-puck/issues/7
- https://github.com/delmaredigital/payload-puck/security/advisories/GHSA-65w6-pf7...
- https://nvd.nist.gov/vuln/detail/CVE-2026-39397
- https://github.com/advisories/GHSA-65w6-pf7x-5g85
Published: 8 Apr 2026 · Updated: 8 Apr 2026 · First seen: 7 Apr 2026