Summary
generated automatically from NVD dataIn @payloadcms/plugin-stripe, an add-on for the Payload headless content management system, an authenticated user who can reach the optional Stripe REST proxy, when enabled, can perform unintended Stripe operations. The weakness is classified as CWE-749 (exposed dangerous method or function). The flaw is rated CRITICAL with a CVSS v3.1 score of 9.6. It affects versions before 3.90.0 and canary versions before 4.0.0-canary.34, and it is fixed in 3.90.0 and 4.0.0-canary.34.
NVD description
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
EPSS · FIRST.org
0.24%probability of exploitation in the next 30 days
Higher than 14% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 6 oct. 2026
- Updated
- 15 oct. 2026
- Status
- Analyzed
- Source
- security-advisories@github.com
Affected products
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-749
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.