CVE-2026-39397: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39397 is a missing authorization vulnerability in @delmaredigital/payload-puck, a PayloadCMS plugin for integrating the Puck visual page builder. All /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with overrideAccess: true by default, effectively bypassing all collection-level access control and silently ignoring any access rules configured by the developer. The vulnerability affects all versions of the package prior to 0.6.23 and was disclosed on April 7, 2026. It carries a CVSS v3.1 base score of 9.4 (Critical) per the GitHub Security Advisory, and 9.8 (Critical) per NVD scoring (GitHub Advisory, Feedly).

The root cause is CWE-862 (Missing Authorization): the endpoint handlers in src/endpoints/index.ts invoked Payload's local API with the hardcoded parameter overrideAccess: true, which is Payload's mechanism to skip access control checks entirely. This meant that any access configuration passed to createPuckPlugin() or defined on Puck-registered collections had no effect on these endpoints. An unauthenticated remote attacker could send standard HTTP requests (GET, POST, PATCH, DELETE) to /api/puck/:collection/* endpoints without any credentials. The fix, applied in commit 9148201, changes all handlers to pass overrideAccess: false and forward the req object so Payload evaluates access rules against the current user (GitHub Advisory, Patch Commit).

An unauthenticated remote attacker can perform full CRUD operations — list all documents (including drafts), read any document by ID, create documents with arbitrary field values, update any document bypassing field-level access rules, delete any document, and read or restore version history — on any collection registered with createPuckPlugin(). In typical installations, this primarily affects the pages collection backing the website's content, meaning an attacker could deface, exfiltrate, or destroy all website pages including unpublished drafts. The scope is limited to collections explicitly registered with the plugin; other Payload collections such as users, media, or business data not exposed to the plugin are not directly reachable through this attack vector (GitHub Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available. The vulnerability was reported via a GitHub issue (Issue #7) by a researcher named Dag-Rui who discovered the bypass during access control testing; the issue contains no step-by-step exploitation guide or attack payload. The EPSS score is approximately 0.038%, indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this CVE (GitHub Issue, Feedly).

1. Reconnaissance: Identify web applications using @delmaredigital/payload-puck versions prior to 0.6.23. This can be done by inspecting package.json files in public repositories, or by probing for the /api/puck/ path on target sites running PayloadCMS.
2. Enumerate collections: Send an unauthenticated HTTP GET request to /api/puck/{collection-slug} (e.g., /api/puck/pages) to list all documents in the collection, including unpublished drafts. No authentication headers are required.
3. Read specific documents: Send a GET request to /api/puck/{collection-slug}/{document-id} to retrieve the full content of any document by ID.
4. Modify content: Send an authenticated-free HTTP PATCH or POST request to /api/puck/{collection-slug}/{document-id} with a JSON body containing arbitrary field values to update or create documents.
5. Delete content: Send an unauthenticated HTTP DELETE request to /api/puck/{collection-slug}/{document-id} to permanently remove any document.
6. Access version history: Send a GET request to /api/puck/{collection-slug}/{document-id}/versions to enumerate version history, and POST to the restore endpoint to roll back or overwrite content with a previous version (GitHub Advisory, GitHub Issue).

• Network: Unauthenticated HTTP GET, POST, PATCH, or DELETE requests to /api/puck/* endpoints from external or unexpected IP addresses; high volume of requests to /api/puck/{collection}/ without corresponding authenticated sessions.
• Logs: Web server or application logs showing requests to /api/puck/ paths with no Authorization header or session cookie; repeated access to /api/puck/{collection}/{id}/versions or /api/puck/{collection}/{id}/restore from a single IP.
• Application State: Unexpected creation, modification, or deletion of page documents in the PayloadCMS admin panel; appearance of new or altered draft pages not corresponding to known editorial activity; version history showing restores not initiated by known users.

Upgrade @delmaredigital/payload-puck to version 0.6.23 or later, which fixes the issue by passing overrideAccess: false and forwarding the request object to Payload's local API in all endpoint handlers. If an immediate upgrade is not possible, place a reverse proxy or middleware authentication check in front of all /api/puck/* routes to require an authenticated session before requests reach the plugin's handlers. Additionally, restrict network-level access to /api/puck/* endpoints to trusted clients only, and audit which collections are registered with createPuckPlugin() to minimize exposure (GitHub Advisory, Patch Commit).

The vulnerability was reported by a community researcher (Dag-Rui) via a GitHub issue, and the maintainer (allandelmare) promptly published a security advisory and released a fix in version 0.6.23. Coverage appeared on threat intelligence aggregators including The Hacker Wire and InfinitSec shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the initial report and fix has been identified (GitHub Issue, GitHub Advisory).