Vulnerability GHSA-r9v2-gg2j-22q5
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
2 hours ago
October 06, 2026 at 04:09 PM UTC
Payload: Insufficient Access Control in Stripe REST Proxy
0.0.1 - 3.89.0 and 4.0.0-canary.0 - 4.0.0-canary.33
0.0.1 - 3.89.0 and 4.0.0-canary.0 - 4.0.0-canary.33
Summary
Payload: Insufficient Access Control in Stripe REST Proxy
Details
Impact
An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy.
You are affected if ALL of these are true:
- Your application uses
@payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled.
- An authenticated user can reach the proxy.
Deployments that do not enable the Stripe REST proxy are not affected.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Upgrading to a patched version is recommended.
If you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.
Impacted packages
Timeline
Published
2 hours ago
October 06, 2026 at 04:09 PM UTC
Fixed (3.90.0)
18 days ago
September 18, 2026 at 02:20 PM UTC
Fixed (4.0.0-canary.34)
18 days ago
September 18, 2026 at 02:28 PM UTC
Last Modified
2 hours ago
October 06, 2026 at 04:15 PM UTC