CVE-2026-39397

Published: Apr 7, 2026Modified: Jul 24, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with the default overrideAccess: true, bypassing all collection-level access control. The access option passed to createPuckPlugin() and any access rules defined on Puck-registered collections were silently ignored on these endpoints. This vulnerability is fixed in 0.6.23.

Affected (1)

Products: Delmaredigital: Payload Puck

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Delmaredigital Payload Puck	Before 0.6.23

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://github.com/delmaredigital/payload-puck/commit/9148201c6bbfa140d44546438027a2f8a70f79a4

Source: security-advisories@github.com

Patch

https://github.com/delmaredigital/payload-puck/issues/7

Source: security-advisories@github.com

ExploitIssue Tracking

https://github.com/delmaredigital/payload-puck/security/advisories/GHSA-65w6-pf7x-5g85

Source: security-advisories@github.com

PatchVendor Advisory

Timeline

No history available yet.