All vulnerabilities
CVE-2026-105848GHSA-r9v2-gg2j-22q5

@payloadcms/plugin-stripe: Payload: Insufficient Access Control in Stripe REST Proxy

payloadcms @payloadcms/plugin-stripenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.90.0Also 4.0.0-canary.34GitHub
Published6 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

  • 3.90.0@payloadcms/plugin-stripe, npmGitHubnpm install @payloadcms/plugin-stripe@3.90.0
  • 4.0.0-canary.34@payloadcms/plugin-stripe, npmGitHubnpm install @payloadcms/plugin-stripe@4.0.0-canary.34

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy.

You are affected if ALL of these are true:

  • Your application uses @payloadcms/plugin-stripe.
  • The optional Stripe REST proxy is enabled.
  • An authenticated user can reach the proxy.

Deployments that do not enable the Stripe REST proxy are not affected.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Upgrading to a patched version is recommended.

If you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.

Text from GitHub Advisory Database

Affected versions 8

  • @payloadcms/plugin-stripe, npm< 3.90.0GitHub
  • @payloadcms/plugin-stripe, npm>= 4.0.0-canary.0, < 4.0.0-canary.34GitHub
  • payloadaffected: < 3.90.0CVE List
  • payloadaffected: >= 4.0.0-canary.0, < 4.0.0-canary.34CVE List
  • plugin-stripeaffected: < 3.90.0CVE List
  • plugin-stripeaffected: >= 4.0.0-canary.0, < 4.0.0-canary.34CVE List
  • @payloadcms/plugin-stripe, npmfrom first release, fixed in 3.90.0OSV
  • @payloadcms/plugin-stripe, npmfrom 4.0.0-canary.0, fixed in 4.0.0-canary.34OSV

References 4