Critical, CVSS 9.4npmAmendedPublished
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
CVE-2026-39397 · GHSA-65w6-pf7x-5g85
- Affected
- npm @delmaredigital/payload-puck < 0.6.23
- Fixed in
- 0.6.23· Vendor fix available
- Issue
- Impact All /api/puck/ CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with the default overrideAccess: true, bypassing all collection-level access control. The access option passed to createPuckPlugin() and any access rules defined on Puck-registered collections were silently ignored on these endpoints. An unauthenticated remote attacker could: - List all documents (including drafts) in any Puck-registered collection - Read any document by ID (including drafts) - Create new documents with arbitrary field values - Update any document (including bypassing field-level access rules) - Delete any document - Read version history and restore arbitrary versions In typical installations, the affected scope is the collection backing the website's pages (default slug: pages). For most users this means an attacker could read, modify, create, or delete every page on the website — including unpublished drafts and version history. Scope is limited to collections…
Recommended action: Upgrade to 0.6.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.