External risk intelligence

Payload Puck API Access Control Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-39397

The vulnerability exists in API endpoints created by a web plugin. Such plugins are commonly used to build internet-facing web applications and content management systems that expose CRUD endpoints to the public network.

Delmaredigital Payload Puck

before 0.6.23

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the @delmaredigital/payload-puck plugin, which affects how data is managed within PayloadCMS. This issue could allow unauthorized access and modification of information by bypassing established security controls. The primary concern is to confirm if this plugin is in use and if so, to understand the scope of potential exposure.

Plugin bypasses data access controls.
Affects data security and integrity.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target an internet-facing web application using the @delmaredigital/payload-puck plugin. If the plugin is configured to use default settings, attackers can send requests to specific API endpoints to bypass access controls. This allows them to perform Create, Read, Update, and Delete operations on data, potentially leading to a complete compromise of the application's data.

No authentication required for access.
Triggered by API requests to /api/puck/*.
Risk of unauthorized data modification.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow unauthorized access to perform Create, Read, Update, and Delete (CRUD) operations on system data. This could occur through exposed API endpoints when the plugin's access controls are bypassed.

Unauthorized data modification or deletion.
Via exposed API endpoints.
Potential compromise of system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners responsible for PayloadCMS instances and the platform or infrastructure teams supporting them should lead the remediation efforts. The immediate first step is to identify all instances of the affected plugin, confirm their exposure to the network and business criticality, and then assign ownership for the remediation plan.

Application owners must own this issue.
Verify API endpoint exposure and business criticality.
Plan remediation and coordinate vendor updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the @delmaredigital/payload-puck plugin?

It is an integration tool for PayloadCMS that enables the use of the Puck visual page builder. Developers use this plugin to simplify the creation and management of page layouts within their content management system, bridging the visual editing experience of Puck with the structured data capabilities of PayloadCMS.

What does CWE-862 mean for CVE-2026-39397?

CWE-862 refers to a 'Missing Authorization' weakness. In the context of this CVE, it means the software fails to verify whether a user is permitted to perform a specific action before granting access. Because of this flaw, the plugin ignores intended security rules and allows unauthorized users to perform CRUD operations on data.

How can an attacker trigger this vulnerability?

An attacker triggers the flaw by sending requests directly to the affected /api/puck/* endpoints. Because the plugin forces an override that grants broad permissions, no special authentication or complex preconditions are required to initiate these requests. Simply accessing these specific API routes is enough to bypass the system's security controls.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal indicates this is a likely risk because the vulnerability exists in API endpoints that are often exposed to the public network. If your web application uses this plugin and is accessible from the internet, the endpoints where this bypass occurs are generally reachable by external parties.

Do I need to update my software to fix this?

Yes. The first step is to check if your project uses a version of @delmaredigital/payload-puck earlier than 0.6.23. If it does, you should plan to update to version 0.6.23 or later, as this release specifically addresses the bypass by correctly enforcing collection-level access control rules.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.