https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 05:55:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-281173 EUVD-2026-281173 https://cve.radiocsirt.org/vuln/euvd-2026-281173 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39397 <p>@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload&#39;s local API with the default overrideAccess: true, bypassing all collection-level access control. The access option passed to createPuckPlugin() and any access rules defined on Puck-registered collections were silently ignored on these endpoints. This vulnerability is fixed in 0.6.23.</p> <p>@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload&#39;s local API with the default overrideAccess: true, bypassing all collection-level access control. The access option passed to createPuckPlugin() and any access rules defined on Puck-registered collections were silently ignored on these endpoints. This vulnerability is fixed in 0.6.23.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39397 https://cve.radiocsirt.org/vuln/ghsa-65w6-pf7x-5g85 <p><strong>Affected:</strong> npm: @delmaredigital/payload-puck</p> <p>### Impact</p> <p>All `/api/puck/*` CRUD endpoint handlers registered by `createPuckPlugin()` called Payload&#39;s local API with the default `overrideAccess: true`, bypassing all collection-level access control. The `access` option passed to `createPuckPlugin()` and any `access` rules defined on Puck-registered collections were silently ignored on these endpoints.</p> <p>An unauthenticated remote attacker could:</p> <p>- List all documents (including drafts) in any Puck-registered collection - Read any document by ID (including drafts) - Create new documents with arbitrary field values - Update any document (including bypassing field-level access rules) - Delete any document - Read version history and restore arbitrary versions</p> <p>**In typical installations**, the affected scope is the collection backing the website&#39;s pages (default slug: `pages`). For most users this means an attacker could read, modify, create, or delete every page on the website — including unpublished drafts and version history.</p> <p>**Scope is limited to collections explicitly registered with `createPuckPlugin()`** — the endpoints validate the collection slug against an allowlist, so attackers cannot pivot to other Payload collections such as `users`, `media`, or business data not exposed to the plugin. The auto-created `puck-templates`, `puck-ai-prompts`, and `puck-ai-context` collections are also outside the allowlist; they have their own dedicated endpoints with separate authentication.</p> <p>Other endpoints in the plugin (AI, styl…</p> <p><strong>Affected:</strong> npm: @delmaredigital/payload-puck</p> <p>### Impact</p> <p>All `/api/puck/*` CRUD endpoint handlers registered by `createPuckPlugin()` called Payload&#39;s local API with the default `overrideAccess: true`, bypassing all collection-level access control. The `access` option passed to `createPuckPlugin()` and any `access` rules defined on Puck-registered collections were silently ignored on these endpoints.</p> <p>An unauthenticated remote attacker could:</p> <p>- List all documents (including drafts) in any Puck-registered collection - Read any document by ID (including drafts) - Create new documents with arbitrary field values - Update any document (including bypassing field-level access rules) - Delete any document - Read version history and restore arbitrary versions</p> <p>**In typical installations**, the affected scope is the collection backing the website&#39;s pages (default slug: `pages`). For most users this means an attacker could read, modify, create, or delete every page on the website — including unpublished drafts and version history.</p> <p>**Scope is limited to collections explicitly registered with `createPuckPlugin()`** — the endpoints validate the collection slug against an allowlist, so attackers cannot pivot to other Payload collections such as `users`, `media`, or business data not exposed to the plugin. The auto-created `puck-templates`, `puck-ai-prompts`, and `puck-ai-context` collections are also outside the allowlist; they have their own dedicated endpoints with separate authentication.</p> <p>Other endpoints in the plugin (AI, styl…</p> https://cve.radiocsirt.org/vuln/ghsa-65w6-pf7x-5g85