CVE-2026-59965: 
JavaScript vulnerability analysis and mitigation

CVE-2026-59965 is an Incorrect Authorization vulnerability in the @jhb.software/payload-alt-text-plugin for Payload CMS, titled "Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission." It affects all versions up to and including v0.7.0 of the npm package. The vulnerability was originally published by the maintainer (jhb-dev) on June 21, 2026, and added to the GitHub Advisory Database on September 10, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Payload Plugins Advisory).

The root cause is CWE-863 (Incorrect Authorization): the plugin's two custom endpoints (POST /api/alt-text-plugin/generate and /bulk) call Payload's Local API methods findByID and update without explicitly setting overrideAccess: false. Payload's internal logic evaluates shouldOverrideAccess = overrideAccess !== false, so omitting the parameter causes it to silently default to true, bypassing all collection-level access control functions entirely. The endpoint access guard in plugin.ts:55 only checks !!req.user (i.e., any authenticated session), and the handler in generateAltText.ts accepts user-controlled id, collection, locale, and update fields from the request body, passing them directly to the unsecured Local API calls at lines 31 and 121. The bulk endpoint (bulkGenerateAltTexts.ts) repeats the same pattern at lines 120 and 170. A public PoC is included in the advisory demonstrating successful exploitation (GitHub Advisory).

Any authenticated user — regardless of role (subscriber, editor, or other low-privilege role) — can read the content of arbitrary upload documents that collection-level access rules would otherwise deny, and can overwrite the alt and keywords fields on those documents without authorization. This results in a low confidentiality impact (unauthorized read of protected document metadata) and a high integrity impact (unauthorized modification of content fields). Operators who restrict upload collection access by role — a common production pattern — are fully impacted, as the plugin endpoints act as an authorization bypass tunnel into Payload's Local API (GitHub Advisory, Payload Plugins Advisory).

A working proof-of-concept is publicly available in the GitHub Security Advisory, including a Dockerized reproduction environment and a curl-based exploit request. Exploitation requires only a valid authenticated session (any role); no admin credentials are needed. As of the advisory publication date, no in-the-wild exploitation or threat actor attribution has been reported, and the CVE status remains "Reserved." No EPSS score or CISA KEV catalog entry is currently available for this CVE (GitHub Advisory).

1. Reconnaissance: Identify a Payload CMS v3 deployment with @jhb.software/payload-alt-text-plugin v0.7.0 or earlier installed and the plugin enabled for one or more upload collections.
2. Obtain a valid session: Authenticate to the Payload CMS application as any user, regardless of role (e.g., a subscriber or editor account). Retrieve the session cookie (payload-token).
3. Identify a target document: Determine the collection name (e.g., media) and the document id (e.g., doc-001) of an upload document whose collection access is restricted to admins.
4. Send the exploit request: Issue a POST request to the plugin's generate endpoint, supplying the target collection, document ID, locale, and update: true:

curl -i -b "payload-token=<SESSION_TOKEN>" \
  -H "Content-Type: application/json" \
  -X POST http://<TARGET>/api/alt-text-plugin/generate \
  --data '{"collection":"media","id":"doc-001","locale":"en","update":true}'

5. Confirm exploitation: The server returns HTTP 200 with the updated altText and keywords values. A subsequent admin read of the document confirms the fields have been overwritten, despite the collection's update access being restricted to admins (GitHub Advisory, Payload Plugins Advisory).

• Network: Unexpected POST requests to /api/alt-text-plugin/generate or /api/alt-text-plugin/bulk originating from non-admin user sessions; requests with "update": true in the body targeting collections the requesting user should not have write access to.
• Logs: Application access logs showing HTTP 200 responses to the above endpoints from low-privilege user accounts; Payload CMS audit logs (if enabled) recording update operations on upload documents by non-admin users.
• Application Data: Unexpected or unauthorized changes to alt and keywords fields on upload/media documents, particularly if the values differ from those set by administrators or content editors with appropriate permissions.

As of the advisory publication date, no patched version of @jhb.software/payload-alt-text-plugin has been released (affected versions: <= 0.7.0, patched versions: None). The recommended interim workaround is to disable or remove the plugin from production deployments until a fix is available. Operators should also audit Payload CMS access logs for unauthorized calls to the /api/alt-text-plugin/generate and /bulk endpoints. When a patched version is released, upgrading immediately is strongly advised (GitHub Advisory, Payload Plugins Advisory).

The vulnerability was discovered by researchers at EQSTLab (reporter) and 232-323 (finder), and disclosed responsibly to the maintainer. The advisory was published by jhb-dev on June 21, 2026, and reviewed and added to the GitHub Advisory Database on September 10, 2026. No significant broader media coverage or notable public social media commentary has been identified at this time (GitHub Advisory).