CVE-2026-39397 Details
Description
@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with the default overrideAccess: true, bypassing all collection-level access control. The access option passed to createPuckPlugin() and any access rules defined on Puck-registered collections were silently ignored on these endpoints. This vulnerability is fixed in 0.6.23.
A vulnerability in the @delmaredigital/payload-puck plugin for PayloadCMS, prior to version 0.6.23, allowed unauthenticated access to Puck-registered collections through the /api/puck/* CRUD endpoints. The issue arose because these endpoints bypassed collection-level access controls, enabling unauthorized users to perform various actions such as listing, reading, creating, updating, and deleting documents, including drafts. This vulnerability is particularly critical for the default 'pages' collection, where it could lead to unauthorized modifications of website content. The flaw has been addressed in version 0.6.23, which now enforces proper access controls on these endpoints.
Users can upgrade to version 0.6.23 to address this vulnerability. For those unable to upgrade immediately, a reverse-proxy or middleware authentication check can be placed in front of the '/api/puck/*' endpoints to require an authenticated session before requests reach the plugin's handlers.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| delmaredigital payload-puck | < 0.6.23 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | New CVE Received | [email protected] |