5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25574

CVE-2026-25574: Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)

Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. This vulnerability has been patched in v3.74.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25574

CVE-2026-25574:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
payload	npm	< 3.74.0	3.74.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in the payload-preferences internal collection. The root cause is insufficient access control in the preferenceAccess function located in packages/payload/src/preferences/config.ts. This function is responsible for determining if a user has permission to access a preference document.

Prior to the patch, the preferenceAccess function only checked if the user.value field (the user's ID) in the preference document matched the ID of the currently authenticated user (req.user.id). In environments with multiple authentication collections (e.g., 'admins' and 'customers') and using a database like Postgres or SQLite with sequential numeric IDs, it's possible for an admin and a customer to have the same numeric ID. This allowed a malicious user from one collection to read or delete the preferences of a user in another collection by crafting a request for a preference associated with their own ID, which would also match the victim's ID.

The patch, identified in commit 2dc2e7c07f24529a28326bd7f5a3fc3597245ebf, rectifies this by adding an additional check to the access control logic. The updated preferenceAccess function now ensures that both the user.value (user ID) and the user.relationTo (the user's collection slug) match the authenticated user's ID and collection. This correctly isolates preferences to each user within their respective authentication collection, mitigating the IDOR vulnerability.

Vulnerable functions

preferenceAccess

packages/payload/src/preferences/config.ts

The `preferenceAccess` function was vulnerable to an Insecure Direct Object Reference (IDOR). It only checked for a matching user ID (`user.value`) to grant access to a preference. In a multi-authentication collection environment, if two users from different collections had the same numeric ID, one user could access the other's preferences. The patch fixes this by adding a condition to also check for the user's collection (`user.relationTo`), ensuring that the user ID and collection both match before granting access.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.