CVE-2026-105848: Payload CMS Stripe Plugin Auth Bypass

CVE-2026-105848 Overview

CVE-2026-105848 affects the @payloadcms/plugin-stripe package used with Payload, an open source headless content management system. The vulnerability allows an authenticated user who can reach the optional Stripe REST proxy to perform unintended Stripe operations through the exposed endpoint. The issue is classified under CWE-749: Exposed Dangerous Method or Function and stems from insufficient access control on the proxy. Payload maintainers fixed the flaw in @payloadcms/plugin-stripe versions 3.90.0 and 4.0.0-canary.34.

Critical Impact
Authenticated users with access to the enabled Stripe REST proxy can invoke Stripe API operations outside of their intended authorization scope.

Affected Products

Payload CMS @payloadcms/plugin-stripe versions prior to 3.90.0
Payload CMS @payloadcms/plugin-stripe canary versions prior to 4.0.0-canary.34
Payload deployments with the optional Stripe REST proxy enabled

Discovery Timeline

2026-10-06 - CVE-2026-105848 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105848

Vulnerability Analysis

The @payloadcms/plugin-stripe package provides an optional REST proxy that forwards requests from the Payload admin environment to the Stripe API. Before version 3.90.0, the proxy relied on authentication alone and did not enforce granular access controls on which Stripe operations an authenticated user could perform. Any user who could reach the proxy endpoint could therefore invoke arbitrary Stripe calls accessible through the configured API key.

Because the proxy executes operations against a merchant's Stripe account, successful abuse affects downstream systems rather than the Payload instance itself. This is reflected in the vector showing impact on the subsequent system's confidentiality and integrity.

Root Cause

The root cause is an exposed dangerous method [CWE-749]: the REST proxy endpoint accepted authenticated requests without constraining which Stripe operations were permitted per user or role. The fix introduces a StripeRESTAccess and StripeRESTConfig configuration surface, along with a sanitizeStripeRESTConfig utility that applies restrictive defaults.

Attack Vector

An authenticated Payload user with network access to the admin API sends a crafted request to the Stripe REST proxy endpoint, specifying a Stripe resource and action the user should not be permitted to invoke. The proxy forwards the call using the server-side Stripe secret, executing the unintended operation.

typescript

// Patch excerpt - packages/plugin-stripe/src/admin.ts
import type { SanitizedStripePluginConfig, StripePluginConfig } from './types.js'

import { getFields } from './fields/getFields.js'
import { sanitizeStripeRESTConfig } from './utilities/sanitizeStripeRESTConfig.js'

export const stripePlugin =
  (incomingPluginConfig: StripePluginConfig) =>

typescript

// Patch excerpt - packages/plugin-stripe/src/exports/types.ts
  SanitizedStripePluginConfig,
  StripePluginConfig,
  StripeProxy,
  StripeRESTAccess,
  StripeRESTConfig,
  StripeWebhookHandler,
  StripeWebhookHandlers,
  SyncConfig,

Source: GitHub commit 2f94a42

Detection Methods for CVE-2026-105848

Indicators of Compromise

Unexpected Stripe API calls originating from the Payload server, especially write operations such as refunds, customer updates, or price changes made outside of normal admin workflows.
Stripe dashboard audit log entries attributed to the API key used by the Payload Stripe proxy during periods when no legitimate admin activity occurred.
Payload server logs showing authenticated requests to the Stripe REST proxy route from low-privilege user accounts.

Detection Strategies

Enumerate running Payload deployments and identify any that bundle @payloadcms/plugin-stripe at a version earlier than 3.90.0 or canary earlier than 4.0.0-canary.34.
Review web server and application logs for requests to the Stripe proxy endpoint and correlate them to the authenticated principal and the Stripe operation invoked.
Compare the set of Stripe operations invoked through the proxy against the set of operations each role is expected to perform.

Monitoring Recommendations

Enable Stripe webhook delivery for sensitive object changes and alert on events that are not tied to a sanctioned admin action.
Forward Payload application and reverse-proxy logs into a central analytics platform and build detections on anomalous access to the Stripe proxy route.
Rotate and scope the Stripe secret key used by Payload so that only the operations required by the application are permitted at the Stripe account level.

How to Mitigate CVE-2026-105848

Immediate Actions Required

Upgrade @payloadcms/plugin-stripe to 3.90.0 or 4.0.0-canary.34 or later across all Payload deployments.
Review the Stripe dashboard audit log and webhook history for operations that may have been invoked through the proxy by unauthorized users.
Rotate the Stripe secret key used by Payload if abuse is suspected or cannot be ruled out.

Patch Information

The maintainers released fixes in Payload v3.90.0 and canary 4.0.0-canary.34. The patch is described in GitHub Security Advisory GHSA-r9v2-gg2j-22q5 and implemented in commit 2f94a42. The fix introduces new StripeRESTAccess and StripeRESTConfig types and a sanitizeStripeRESTConfig utility to restrict REST proxy access.

Workarounds

Disable the optional Stripe REST proxy in the plugin configuration if it is not required by the application.
Restrict network reachability of the Payload admin API to trusted operators until the upgrade is applied.
Downscope the Stripe API key used by the proxy to the minimum set of resources and actions required by the application.

bash

# Upgrade the Payload Stripe plugin to a fixed version
npm install @payloadcms/plugin-stripe@^3.90.0

# Verify the installed version
npm ls @payloadcms/plugin-stripe