CVE-2026-39397
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The @delmaredigital/payload-puck plugin for PayloadCMS prior to 0.6.23 registers /api/puck/* CRUD endpoints that call Payload's local API with default overrideAccess: true, bypassing all collection-level access control. Access options passed to createPuckPlugin() and access rules on Puck-registered collections are ignored.
Risk Assessment
Unauthenticated users can perform CRUD operations on data managed by Puck, leading to unauthorized access, modification, and potential data leakage.
Recommendation
Upgrade @delmaredigital/payload-puck to version 0.6.23 or later. Verify that access rules are correctly enforced after the update.
Original NVD description (English source)
@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with the default overrideAccess: true, bypassing all collection-level access control. The access option passed to createPuckPlugin() and any access rules defined on Puck-registered collections were silently ignored on these endpoints. This vulnerability is fixed in 0.6.23.