CVE-2026-105850: Payload CMS Stripe Payment Processing Flaw

CVE-2026-105850 Overview

CVE-2026-105850 is a business logic flaw in the @payloadcms/plugin-ecommerce package for Payload, an open source headless content management system. The Stripe payment adapter allows a single Stripe order confirmation to be processed more than once under certain conditions. This creates a settlement replay condition that can corrupt order state and financial records. The issue is tracked under [CWE-837: Improper Enforcement of a Single, Unique Action]. Maintainers released fixes in versions 3.90.0 and 4.0.0-canary.34.

Critical Impact
Attackers or race conditions can trigger duplicate processing of Stripe order confirmations, resulting in integrity loss across order and transaction records in Payload-powered storefronts.

Affected Products

@payloadcms/plugin-ecommerce versions before 3.90.0
@payloadcms/plugin-ecommerce canary versions before 4.0.0-canary.34
Payload CMS deployments using the Stripe payment adapter

Discovery Timeline

2026-10-06 - CVE CVE-2026-105850 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105850

Vulnerability Analysis

The flaw sits in the Stripe payment adapter path of the Payload ecommerce plugin. When Stripe sends an order confirmation, the plugin fails to enforce idempotent handling of that confirmation event. A second confirmation for the same order can therefore proceed through the full settlement workflow instead of being rejected. The result is duplicated transaction records and inconsistent order status transitions.

The patch adds an intermediate processing status to the status field and threads a dedicated transactionsSlug into the plugin configuration. Together these changes let the plugin reserve a transaction row and gate further processing on its state, preventing a replay from re-entering the settlement path.

Root Cause

The root cause is improper enforcement of a single, unique action [CWE-837]. The Stripe adapter did not atomically mark an order confirmation as consumed before executing side effects. Without a durable processing state and a transactions collection reference, repeated confirmation events for the same order were treated as independent, legitimate settlements.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An adversary who can cause Stripe to redeliver a confirmation, or who can replay a webhook delivery to the Payload endpoint, can drive the plugin to settle the same order multiple times. Misconfigured retry behavior on the Stripe side can produce the same effect without a deliberate attacker.

typescript

// Patch: packages/plugin-ecommerce/src/fields/statusField.ts
// Adds an intermediate 'processing' status used to gate replays.
     label: ({ t }) => t('plugin-ecommerce:pending'),
     value: 'pending',
   },
+  {
+    // @ts-expect-error - translations are not typed in plugins yet
+    label: ({ t }) => t('plugin-ecommerce:processing'),
+    value: 'processing',
+  },
   {
     // @ts-expect-error - translations are not typed in plugins yet
     label: ({ t }) => t('plugin-ecommerce:succeeded'),

Source: payloadcms/payload commit 6c0c4dc

typescript

// Patch: packages/plugin-ecommerce/src/index.ts
// Threads transactionsSlug so the adapter can record and check prior settlements.
         customersSlug: collectionSlugMap.customers,
         enableVariants,
         productsSlug: collectionSlugMap.products,
+        transactionsSlug: collectionSlugMap.transactions,
         variantsSlug: collectionSlugMap.variants ?? 'variants',
       })

Source: payloadcms/payload commit 6c0c4dc

Detection Methods for CVE-2026-105850

Indicators of Compromise

Multiple transaction records in the Payload transactions collection referencing the same Stripe payment_intent or charge identifier.
Orders transitioning from succeeded back through earlier states, or duplicate succeeded events for a single order ID.
Repeated Stripe webhook deliveries to the Payload endpoint for the same event ID with HTTP 200 responses from the application.

Detection Strategies

Query the ecommerce database for orders where the count of linked transactions exceeds one for a single Stripe reference.
Reconcile Payload order totals against Stripe dashboard settlement reports and flag mismatches.
Instrument the Stripe webhook handler to log event IDs and alert on any event ID processed more than once.

Monitoring Recommendations

Enable application-level logging of all Stripe webhook events, including event ID, order ID, and resulting status transition.
Forward webhook and ecommerce plugin logs to a centralized analytics platform and alert on duplicate settlement patterns.
Monitor Stripe's webhook delivery dashboard for elevated retry rates targeting the Payload endpoint.

How to Mitigate CVE-2026-105850

Immediate Actions Required

Upgrade @payloadcms/plugin-ecommerce to version 3.90.0 or later on the stable branch.
Upgrade canary deployments to 4.0.0-canary.34 or later.
Audit recent Stripe transactions in the Payload database for duplicates and reconcile against Stripe records before issuing refunds.

Patch Information

The fix is delivered in Payload ecommerce plugin versions 3.90.0 and 4.0.0-canary.34. The change introduces a processing order status and wires a transactionsSlug into the plugin so the Stripe adapter can gate repeat confirmations against existing transaction records. Full details are available in the GitHub Security Advisory GHSA-8r29-2mp2-pmrw and the GitHub Release v3.90.0.

Workarounds

Restrict the Stripe webhook endpoint to Stripe source IP ranges and verify webhook signatures on every request.
Add application middleware that deduplicates Stripe events by event.id before they reach the ecommerce plugin.
Temporarily disable the Stripe payment adapter in Payload until the plugin can be upgraded to a fixed version.

bash

# Upgrade the plugin to a patched release
npm install @payloadcms/plugin-ecommerce@3.90.0

# Or for canary channel
npm install @payloadcms/plugin-ecommerce@4.0.0-canary.34