payload-puck vulnerabilities

1 known vulnerability in payload-puck from Delmaredigital. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  payload-puck: Missing Authorization

  CVE-2026-39397Apr 7, 2026Delmaredigital

  @delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with the default overrideAccess: true, bypassing a