GHSA-jq29-r496-r955
Medium · 5.4CVSS
5.4
EPSS
—
Published
Feb 5, 2026
CISA due date
—
The record
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | payload | 0 | 3.74.0 |
Related vulnerabilities
- CVE-2026-25574 Payload is a free and open source headless content management system. Same vulnerability
- GHSA-p6mr-xf3r-ghq4 Payload has a CSRF Protection Bypass in Authentication Flow Also affects payload
- GHSA-6r7f-q7f5-wpx8 Payload has Authenticated SSRF via Upload Functionality Also affects payload
- GHSA-7xxh-373w-35vg Payload has an SQL Injection via Query Handling Also affects payload
- CVE-2026-34749 Payload is a free and open source headless content management system. Also affects payload
- CVE-2026-34746 Payload is a free and open source headless content management system. Also affects payload
- CVE-2026-34747 Payload is a free and open source headless content management system. Also affects payload
- CVE-2026-34751 Payload is a free and open source headless content management system. Also affects payload