CVE-2026-25574 json
Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)
published 2026-02-05 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-5571 , GHSA-jq29-r496-r955
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. This vulnerability has been patched in v3.74.0.
Patch / fix
- npm payload 3.74.0
- payloadcms payload 3.74.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | payload | <3.74.0 |
3.74.0 |
Affected products
- payloadcms payload
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/payloadcms/payload/security/advisories/GHSA-jq29-r496-r955
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-25574
advisory
-
github.com
/payloadcms/payload
package
Sources
- CVE List CVE-2026-25574
- GitHub Advisory GHSA-jq29-r496-r955
- NVD CVE-2026-25574
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.