CVE-2026-105848: Insufficient Access Control in @payloadcms/plugin-stripe
Summary
CVE-2026-105848: Payload: Insufficient Access Control in Stripe REST Proxy. Affects @payloadcms/plugin-stripe across 2 version ranges.
< 3.90.0
>= 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @payloadcms/plugin-stripe package is a plugin for Payload CMS that facilitates integration with Stripe's payment processing services. It allows developers to manage payments, subscriptions, and other financial transactions seamlessly within their applications. However, a vulnerability exists in the optional Stripe REST proxy feature, which, if improperly secured, can lead to unauthorized access and unintended operations by authenticated users.
Vulnerability Detail
The vulnerability arises from insufficient access control in the Stripe REST proxy of the @payloadcms/plugin-stripe package. If an authenticated user can access this proxy, they may perform unintended Stripe operations, potentially compromising sensitive financial data and operations. This issue is particularly concerning for applications that rely on the proxy for payment processing, as it could lead to unauthorized transactions or data exposure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.90.03.90.0npm install @payloadcms/plugin-stripe@3.90.0 -
>= 4.0.0-canary.0, < 4.0.0-canary.344.0.0-canary.34npm install @payloadcms/plugin-stripe@4.0.0-canary.34
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling the Stripe REST proxy to mitigate the risk. If the proxy must remain enabled, restrict access to trusted users and limit the operations they can perform. This can be achieved by implementing proper authentication and authorization checks in your application.
Conclusion
In summary, CVE-2026-105848 presents a significant risk for applications using the @payloadcms/plugin-stripe package with the Stripe REST proxy enabled. It is crucial to upgrade to the patched versions or implement workarounds to safeguard against unauthorized access and potential financial implications.
See every vulnerability recorded for @payloadcms/plugin-stripe →
FAQ
CVE-2026-105848 is a vulnerability in the @payloadcms/plugin-stripe package that allows authenticated users to perform unintended Stripe operations due to insufficient access control in the Stripe REST proxy.
Your application is affected if it uses the @payloadcms/plugin-stripe package, has the Stripe REST proxy enabled, and allows authenticated users to access the proxy.
If you cannot upgrade immediately, disable the Stripe REST proxy or restrict access to it for trusted users only.
The consequences include unauthorized access to Stripe operations, which can lead to financial loss, data exposure, and compromised user trust.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
