Περιγραφή
@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload-s local API with the default overrideAccess: true, bypassing all collection-level access control. The access option passed to createPuckPlugin() and any access rules defined on Puck-registered collections were silently ignored on these endpoints. This vulnerability is fixed in 0.6.23.
CVSS 9.4EPSS 0.376%Κίνδυνος 0.97
Προβολή πηγής- Δημοσίευση
- 2026-04-07 21:17:18
- Επηρεαζόμενες εκδόσεις
- <0.6.23
- Τύπος
- Package
- Τελευταία τροποποίηση
- 2026-07-24 21:10:00
- Διάνυσμα
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L