CVE-2026-25574
published 2026-02-06CVE-2026-25574: Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability…
PriorityP430medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.19%
9.1th percentile
Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. This vulnerability has been patched in v3.74.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| payloadcms | payload | < 3.74.0 | 3.74.0 |
| payloadcms | payload | >= 0 < 3.74.0 | 3.74.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
ghsa·2026-02-05
CVE-2026-25574 [MEDIUM] CWE-639 payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
### Impact
A cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the `payload-preferences` internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide.
**Users are affected if ALL of these are true:**
- Multiple auth collections configured (e.g., `admins` + `customers`)
- Postgres or SQLite database adapter with serial/auto-increment IDs
- Users in different auth collections with the same numeric ID
**Not affected:**
- `@payloadcms/db-mongodb` adapte
OSV
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
osv·2026-02-05
CVE-2026-25574 [MEDIUM] payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
### Impact
A cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the `payload-preferences` internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide.
**Users are affected if ALL of these are true:**
- Multiple auth collections configured (e.g., `admins` + `customers`)
- Postgres or SQLite database adapter with serial/auto-increment IDs
- Users in different auth collections with the same numeric ID
**Not affected:**
- `@payloadcms/db-mongodb` adapte
No detection rules found.
No public exploits indexed.
2026-02-06
Published