CVE-2026-105848: Payload: Insufficient Access Control in Stripe REST Proxy

October 6, 2026

An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy.

You are affected if ALL of these are true:

Your application uses @payloadcms/plugin-stripe.
The optional Stripe REST proxy is enabled.
An authenticated user can reach the proxy.

Deployments that do not enable the Stripe REST proxy are not affected.

References

github.com/advisories/GHSA-r9v2-gg2j-22q5
github.com/payloadcms/payload/commit/2f94a4205e5ba3ec0e91c92ed54f24f429826dd0
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-r9v2-gg2j-22q5
nvd.nist.gov/vuln/detail/CVE-2026-105848

Code Behaviors & Features

Detect and mitigate CVE-2026-105848 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →