CVE-2026-59965: Payload CMS Alt-Text Plugin Auth Bypass

CVE-2026-59965 Overview

CVE-2026-59965 is a broken authorization vulnerability [CWE-863] in the @jhb.software/payload-alt-text-plugin package, part of the Payload Plugins collection for Payload CMS. Version 0.7.0 exposes two REST endpoints, POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk, that accept any authenticated user by default. The endpoints call req.payload.findByID and req.payload.update without setting overrideAccess: false, so Payload defaults to overrideAccess: true and skips the target collection's read and update access functions. Version 0.8.0 remediates the flaw.

Critical Impact
An authenticated low-privilege user can read arbitrary protected upload documents and overwrite their alt and keywords fields, even when the collection restricts those operations to administrators.

Affected Products

@jhb.software/payload-alt-text-plugin version 0.7.0
Payload CMS installations bundling the vulnerable plugin
Applications exposing the plugin's /api/alt-text-plugin/generate and /api/alt-text-plugin/bulk routes

Discovery Timeline

2026-09-15 - CVE-2026-59965 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-59965

Vulnerability Analysis

The plugin's default endpoint guard authorizes any authenticated request, delegating fine-grained checks to Payload's Local API. However, the handlers in alt-text/src/endpoints/generateAltText.ts and alt-text/src/endpoints/bulkGenerateAltTexts.ts invoke Local API operations without specifying overrideAccess: false. Payload defaults overrideAccess to true, which bypasses the collection's read and update access functions entirely.

A control call issued via the Local API with overrideAccess: false is denied, confirming that the endpoints, not the collection rules, are the point of failure. The result is a horizontal and vertical privilege escalation surface reachable by any logged-in user.

Root Cause

The root cause is missing authorization enforcement in server-side handlers. By omitting overrideAccess: false and not propagating req.user, the plugin executes privileged Local API operations under Payload's implicit administrative context.

Attack Vector

An authenticated low-privilege user submits id, collection, locale, and update values to either endpoint. The handler retrieves the target document with findByID and writes attacker-controlled alt and keywords values via update, regardless of the collection's configured access controls.

typescript

// Patch from commit e39634868ce13a414e2981e219befc58101654d3
// alt-text/src/endpoints/bulkGenerateAltTexts.ts
    id,
    collection,
    depth: 0,
+   // Run under the requesting user's access, not Payload's default
+   // `overrideAccess: true`, so collection-level access control applies.
+   overrideAccess: false,
+   user: req.user,
  })

  if (!imageDoc) {

Source: GitHub Commit e396348

Detection Methods for CVE-2026-59965

Indicators of Compromise

Requests to POST /api/alt-text-plugin/generate or POST /api/alt-text-plugin/bulk originating from non-administrative user sessions.
Unexpected modifications to alt or keywords fields on upload documents in collections where those fields are administrator-restricted.
Successful reads of protected upload documents by users whose roles lack read access to the underlying collection.

Detection Strategies

Audit Payload CMS application logs for calls to the alt-text plugin endpoints and correlate them against the caller's role.
Compare recent revisions of upload documents to identify unauthorized changes to alt and keywords metadata.
Enumerate installed plugin versions and flag any host running @jhb.software/payload-alt-text-plugin@0.7.0.

Monitoring Recommendations

Enable request logging with authenticated user identity on all /api/alt-text-plugin/* routes.
Alert on bulk update operations that target upload collections outside standard administrative workflows.
Track document revision history for anomalous edits performed by low-privilege accounts.

How to Mitigate CVE-2026-59965

Immediate Actions Required

Upgrade @jhb.software/payload-alt-text-plugin to version 0.8.0 or later.
Review upload collection documents for unauthorized changes to alt and keywords fields and restore correct values from backup where necessary.
Rotate any credentials or session tokens for accounts observed exercising the vulnerable endpoints.

Patch Information

The fix is released in alt-text 0.8.0 via Pull Request #159. The patch adds overrideAccess: false and forwards req.user on the Local API calls in generateAltText.ts and bulkGenerateAltTexts.ts, ensuring collection-level access control applies. See the GitHub Security Advisory GHSA-4qpv-39hg-f7fx for the full disclosure.

Workarounds

Replace the default endpoint guard with a custom access function that restricts the plugin routes to administrators.
Disable or unmount the /api/alt-text-plugin/generate and /api/alt-text-plugin/bulk routes until upgrade is possible.
Front the Payload API with a reverse proxy that denies non-administrator requests to the alt-text plugin paths.

bash

# Upgrade the vulnerable package to the fixed release
pnpm update @jhb.software/payload-alt-text-plugin@^0.8.0
# or
npm install @jhb.software/payload-alt-text-plugin@0.8.0