9.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-39397

CVE-2026-39397: @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections

@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with the default overrideAccess: true, bypassing all collection-level access control. The access option passed to createPuckPlugin() and any access rules defined on Puck-registered collections were silently ignored on these endpoints. This vulnerability is fixed in 0.6.23.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-39397

CVE-2026-39397:

9.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@delmaredigital/payload-puck	npm	< 0.6.23	0.6.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the @delmaredigital/payload-puck package, where the CRUD API endpoints for Puck-registered collections were missing authorization. The root cause was that the endpoint handlers, created by functions in src/endpoints/index.ts, were calling Payload's local API with the default setting of overrideAccess: true. This setting bypasses all collection-level access control checks, allowing any unauthenticated user to perform create, read, update, and delete operations on any document within the Puck-registered collections.

The patch, identified in commit 9148201c6bbfa140d44546438027a2f8a70f79a4, addresses this issue by explicitly setting overrideAccess: false and passing the req object in all calls to Payload's local API within these handlers. This change ensures that Payload's access control mechanism is properly invoked, and the access rules defined for the collection are evaluated against the current user's session, thus preventing unauthorized access. The affected functions are createListHandler, createCreateHandler, createGetHandler, createUpdateHandler, createDeleteHandler, createVersionsHandler, and createRestoreHandler, each corresponding to a different CRUD operation.

Vulnerable functions

createListHandler

src/endpoints/index.ts

The `createListHandler` function returns a request handler that lists documents in a collection. Prior to the patch, the call to `req.payload.find` did not enforce access control because it implicitly used `overrideAccess: true`. This allowed an unauthenticated attacker to list all documents. The patch fixes this by adding `req` and `overrideAccess: false` to the call, ensuring Payload's access control is applied.

createCreateHandler

src/endpoints/index.ts

The `createCreateHandler` function returns a request handler for creating new documents. The vulnerability lies in the `req.payload.create` call, which did not have access control checks (`overrideAccess: true` by default). This allowed an unauthenticated attacker to create documents with arbitrary data. The fix adds `req` and `overrideAccess: false` to enforce authorization.

createGetHandler

src/endpoints/index.ts

The `createGetHandler` function returns a request handler to fetch a single document by its ID. The `req.payload.findByID` call was insecure as it bypassed access controls, allowing an unauthenticated attacker to read any document. The patch secures this by adding `req` and `overrideAccess: false` to the API call.

createUpdateHandler

src/endpoints/index.ts

The `createUpdateHandler` function returns a request handler for updating documents. It was vulnerable because the `req.payload.update` call did not enforce access controls, allowing an unauthenticated attacker to modify any document. The patch mitigates this by including `req` and `overrideAccess: false` in the call.

createDeleteHandler

src/endpoints/index.ts

The `createDeleteHandler` function returns a request handler for deleting documents. The `req.payload.delete` call was missing authorization checks, which allowed an unauthenticated attacker to delete any document. The fix involves adding `req` and `overrideAccess: false` to enforce access control.

createVersionsHandler

src/endpoints/index.ts

The `createVersionsHandler` function returns a request handler to get the version history of a document. It was vulnerable because `req.payload.findVersions` did not enforce access control, allowing an unauthenticated attacker to view version history. The patch adds `req` and `overrideAccess: false` to ensure authorization.

createRestoreHandler

src/endpoints/index.ts

The `createRestoreHandler` function returns a request handler to restore a document to a previous version. The `req.payload.restoreVersion` call was insecure as it lacked authorization checks. This allowed an unauthenticated attacker to restore any document to any of its previous versions. The patch fixes this by adding `req` and `overrideAccess: false`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.