« Volver al listado

CVE-2026-25574

Estado: AnalizadaMedia (5.4)—

Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. This vulnerability has been patched in v3.74.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Payloadcms — Payload

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25574",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25574",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-09T15:19:22.550674Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "payloadcms",
          "product": "payload",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.74.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-06T22:16:11.740",
  "references": [
    {
      "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-jq29-r496-r955",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. This vulnerability has been patched in v3.74.0."
    },
    {
      "lang": "es",
      "value": "Payload es un sistema de gestión de contenido sin interfaz, de código abierto y gratuito. Antes de la versión 3.74.0, existe una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) entre colecciones en la colección interna payload-preferences. En entornos de colecciones de autenticación múltiple que utilizan Postgres o SQLite con IDs seriales/auto-incrementales predeterminados, los usuarios autenticados de una colección de autenticación pueden leer y eliminar preferencias que pertenecen a usuarios en diferentes colecciones de autenticación cuando sus IDs numéricos colisionan. Esta vulnerabilidad ha sido parcheada en la versión 3.74.0."
    }
  ],
  "lastModified": "2026-06-17T10:24:52.987",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EE81572-2333-46CC-B577-ED74968D43D6",
              "versionEndExcluding": "3.74.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}