CVE-2026-25574: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25574 is a cross-collection Insecure Direct Object Reference (IDOR) vulnerability in the payload-preferences internal collection of Payload CMS, an open-source headless content management system. It affects all versions of the payload npm package prior to 3.74.0 and was disclosed on February 5, 2026, by researcher s2ongmo. The vulnerability allows authenticated users from one auth collection to read and delete preferences belonging to users in a different auth collection when their numeric IDs collide. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Payload Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the payload-preferences collection does not enforce cross-collection isolation when resolving user preferences by numeric ID. In multi-auth collection environments (e.g., separate admins and customers collections) backed by Postgres or SQLite using default serial/auto-increment integer IDs, two users in different collections can share the same numeric ID. An authenticated attacker can supply a colliding ID to access or delete another collection's user preferences without authorization. The vulnerability does not affect deployments using the MongoDB adapter or those configured with idType: 'uuid', as UUIDs are globally unique and eliminate ID collision (GitHub Advisory, Payload Advisory).

Successful exploitation allows an authenticated attacker to read user preferences from a different auth collection (limited confidentiality impact) and delete those preferences (limited integrity impact); availability is not affected. The scope is limited to the payload-preferences internal collection and does not expose full user records, credentials, or other sensitive data. The practical risk is highest in applications where user preferences store meaningful configuration or personalization data, and where ID collisions between auth collections are likely as user counts grow (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.015% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability requires the attacker to already be authenticated (low privileges required), and exploitation is only possible in specific deployment configurations (multi-auth collections with Postgres/SQLite and serial IDs). It is not listed in the CISA Known Exploited Vulnerabilities catalog, and no threat actor attribution has been identified (GitHub Advisory).

1. Identify target environment: Confirm the Payload CMS instance uses multiple auth collections (e.g., admins and customers) with a Postgres or SQLite database adapter and default serial/auto-increment integer IDs (not UUID).
2. Authenticate as a low-privileged user: Obtain valid credentials for any auth collection (e.g., register or log in as a customers collection user with a known numeric ID, such as ID 5).
3. Enumerate colliding IDs: Determine or guess that a user in a different auth collection (e.g., admins) shares the same numeric ID (5), which is likely as both collections use independent auto-increment sequences starting from 1.
4. Read cross-collection preferences: Send an authenticated API request to the payload-preferences endpoint using the colliding numeric ID to retrieve preferences belonging to the admin user (e.g., GET /api/payload-preferences/<id>).
5. Delete cross-collection preferences: Send an authenticated DELETE request to the same endpoint to remove the target user's preferences, causing data loss for that user (GitHub Advisory, Payload Advisory).

• Network: Unusual API requests to /api/payload-preferences/<numeric-id> (GET or DELETE) from authenticated users whose collection does not match the owner of the referenced preference record; cross-collection access patterns where a customers collection token is used to access admin-owned preference IDs.
• Logs: Application access logs showing repeated GET or DELETE requests to the preferences endpoint with sequential or guessed numeric IDs from a single authenticated session; HTTP 200 responses to preference requests where the requesting user's collection differs from the preference owner's collection.
• Application Behavior: Missing or unexpectedly deleted user preferences for admin or other high-privilege collection users, particularly after activity from lower-privilege collection accounts.

The vulnerability has been patched in Payload CMS version 3.74.0; users should upgrade to v3.74.0 or later immediately. There is no configuration-based workaround available — the vendor explicitly states that upgrading is the only remediation. As an architectural mitigation prior to upgrading, deployments can switch to idType: 'uuid' for their Postgres or SQLite adapter, which eliminates ID collisions across collections, or consolidate to a single auth collection if feasible (GitHub Advisory, Payload Advisory).

The advisory was published by Payload CMS maintainer denolfe on February 5, 2026, and credited researcher s2ongmo for the discovery. The vulnerability received standard tracking across vulnerability databases (NVD, Red Hat CVE, INCIBE) but generated no notable public commentary, media coverage, or significant social media discussion, consistent with its moderate severity and narrow exploitation conditions (Payload Advisory).