Attack Chain

1. An attacker identifies a PayloadCMS instance running a vulnerable version of the @delmaredigital/payload-puck plugin (prior to 0.6.23).
2. The attacker crafts a malicious HTTP request targeting a /api/puck/* endpoint, such as /api/puck/pages/create, /api/puck/pages/update, or /api/puck/pages/delete.
3. The attacker injects unauthorized data or commands within the request body, exploiting the lack of access control checks.
4. The createPuckPlugin() function processes the request, calling Payload's local API with overrideAccess: true.
5. PayloadCMS's access control mechanisms are bypassed due to the overrideAccess setting.
6. The attacker's unauthorized data or commands are executed, potentially creating, updating, or deleting sensitive data within the PayloadCMS instance.
7. The attacker may escalate privileges by modifying user roles or creating new administrative accounts via the exposed API endpoints.
8. The attacker exfiltrates sensitive data or defaces the website.

Impact

Successful exploitation of this vulnerability allows attackers to bypass access controls and perform unauthorized CRUD operations on PayloadCMS collections. This could lead to data breaches, data manipulation, privilege escalation, and complete compromise of the affected PayloadCMS instance. The impact is particularly severe for organizations relying on PayloadCMS to manage sensitive content or critical business processes. The CVSS v3.1 base score is 9.4, indicating a critical severity.

Recommendation

• Upgrade the @delmaredigital/payload-puck plugin to version 0.6.23 or later to remediate the access control bypass vulnerability (CVE-2026-39397).
• Deploy the provided Sigma rule "Detect Unauthorized Access to PayloadCMS Puck Endpoints" to identify potential exploitation attempts targeting the /api/puck/* endpoints.
• Review and audit existing PayloadCMS access control configurations to ensure proper restrictions are in place after upgrading the @delmaredigital/payload-puck plugin.