Summary
Payload: Insufficient Access Control in Stripe REST Proxy
Advisory details
Impact
An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy.
You are affected if ALL of these are true:
- Your application uses
@payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled.
- An authenticated user can reach the proxy.
Deployments that do not enable the Stripe REST proxy are not affected.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Upgrading to a patched version is recommended.
If you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-102682
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
- CRITICALCVE-2026-102748
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
- HIGHCVE-2026-85990
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
- HIGHCVE-2026-84315
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
- MEDIUMGHSA-3hc7-r24j-rpwc
Vikunja: Cross-project task disclosure through subtask expansion
- MEDIUMGHSA-g38j-7v97-x298
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID