CVE-2026-105848: Payload: Insufficient Access Control in Stripe REST Proxy
Impact
An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy.
You are affected if ALL of these are true:
- Your application uses @payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy.
Deployments that do not enable the Stripe REST proxy are not affected.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Upgrading to a patched version is recommended.
If you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.
Other sources
Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@payloadcms/plugin-stripeto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/@payloadcms/plugin-stripeto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
@payloadcms/plugin-stripeto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
@payloadcms/plugin-stripeto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Configuration
Disable the optional Stripe REST proxy if you cannot upgrade immediately.
optional Stripe REST proxy enabled = false - Compensating control
If the optional Stripe REST proxy must remain enabled, restrict access to trusted users and allow only the required Stripe operations.
Event History
Frequently Asked Questions
Which deployments are affected?
A deployment is affected only if it uses @payloadcms/plugin-stripe, has enabled the optional Stripe REST proxy, and allows an authenticated user to reach that proxy. Deployments where the Stripe REST proxy is not enabled are not affected.
What access does an attacker need?
The attacker must be authenticated and able to reach the enabled Stripe REST proxy. No user interaction is required.
What should we do if we cannot upgrade immediately?
Disable the Stripe REST proxy if possible. If it must remain enabled, restrict it to trusted users and permit only the Stripe operations that are required.
Which versions contain the fix?
Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later for the canary release line.