CVE-2026-105848 is a critical-rated (CVSS 9.6) authorization flaw in @payloadcms/plugin-stripe for the Payload CMS. When the optional Stripe REST proxy is enabled, an authenticated user can perform Stripe operations they should not. Upgrade to 3.90.0, or 4.0.0-canary.34 on the canary line, or disable the proxy.
What's affected
The GitHub advisory lists @payloadcms/plugin-stripe before 3.90.0, and canary versions before 4.0.0-canary.34, as affected. The patched versions are 3.90.0 and 4.0.0-canary.34.
You are affected only if all of these hold: your app uses @payloadcms/plugin-stripe, the optional Stripe REST proxy is enabled, and an authenticated user can reach the proxy. Deployments without the proxy are not affected.
On severity, NVD shows 9.6 while the advisory itself rates it Moderate, 6.4 on CVSS v4. Expect to see both numbers.
How to check if you're exposed
Check the plugin version and configuration:
npm ls @payloadcms/plugin-stripe payload
grep -rn "stripePlugin" --include=*.ts --include=*.js .
Check the configuration for the option that enables the Stripe REST proxy. If it is off, you are outside the described condition. If it is on, list which roles can reach the proxy.
What to do now
- Upgrade Payload packages to 3.90.0 or later, or 4.0.0-canary.34 or later if you run canary builds.
- If you cannot upgrade, disable the Stripe REST proxy, as the advisory suggests.
- If the proxy must stay on, restrict it to trusted users and to the Stripe operations you actually need.
- Review the Stripe restricted key your app uses and cut its permissions to the minimum.
- Check recent Stripe activity for operations you did not expect.
Why it matters
A proxy that forwards authenticated requests to a payment provider carries the app's own authority. If it does not limit which operations a user may request, any logged-in user inherits whatever the Stripe key can do. The record files this under CWE-862 (missing authorization) and CWE-749 (exposed dangerous method or function).
The cure on the app side is to forward only a short list of calls and to check the user's role for each. The cure on the Stripe side is to give the key only the permissions needed, so a mistake in the app cannot reach everything.
The record does not report exploitation in the wild, and the KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the severity numbers differ?
NVD scores it 9.6 with CVSS v3.1. The advisory gives its own CVSS v4 score of 6.4 and calls it Moderate. Base your priority on whether the proxy is enabled and who can reach it.
Sources
Last reviewed: 19 October 2026.
