@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
Date: 2026-04
Affected: npm/@delmaredigital/payload-puck
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-39397
CWE: CWE-862
CVSS: 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)

### Impact All `/api/puck/*` CRUD endpoint handlers registered by `createPuckPlugin()` called Payload's local API with the default `overrideAccess: true`, bypassing all collection-level access control. The `access` option passed to `createPuckPlugin()` and any `access` rules defined on Puck-registered collections were silently ignored on these endpoints. An unauthenticated remote attacker could: - List all documents (including drafts) in any Puck-registered collection - Read any document by ID (including drafts) - Create new documents with arbitrary field values - Update any document (including bypassing field-level access rules) - Delete any document - Read version history and restore arbitrary versions **In typical installations**, the affected scope is the collection backing the website's pages (default slug: `pages`). For most users this means an attacker could read, modify, create, or delete every page on the website — including unpublished drafts and version history. **Scope is limited to collections explicitly registered with `createPuckPlugin()`** — the endpoints validate the collection slug against an allowlist, so attackers cannot pivot to other Payload collections such as `users`, `media`, or business data not exposed to the plugin. The auto-created `puck-templates`, `puck-ai-prompts`, and `puck-ai-context` collections are also outside the allowlist; they have their own dedicated endpoints with separate authentication. Other endpoints in the plugin (AI, style


Mitigations:

Architectural layers (MAESTRO):