CVE-2026-39397 is a critical missing authorization flaw (CVSS 9.4) in @delmaredigital/payload-puck, a PayloadCMS plugin for the Puck page builder. Its /api/puck endpoints called Payload with access control overridden, so collection rules were ignored. Versions before 0.6.23 are affected, and 0.6.23 fixes it.
What's affected
@delmaredigital/payload-puck before 0.6.23 is affected. The fixed version is 0.6.23.
The advisory says the access option passed to createPuckPlugin(), and any access rules on Puck registered collections, were silently ignored on these endpoints.
How to check if you're exposed
npm ls @delmaredigital/payload-puck
npm explain @delmaredigital/payload-puck
For pnpm or yarn, use pnpm why or yarn why with the same package name.
What to do now
- Upgrade with
npm install @delmaredigital/payload-puck@latestand confirm 0.6.23 or later. - Redeploy the Payload application.
- Review content in Puck registered collections for changes you cannot explain.
- Do not assume your access rules protected these routes before the upgrade.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
This is CWE-862 (Missing Authorization). Payload's local API skips access checks when overrideAccess is true, which is the default. A handler that calls it on behalf of a request must pass the user and turn the override off, otherwise the rules you wrote never run.
The lesson reaches beyond this plugin. Configured rules that look protective can be bypassed by one default in code. The record does not flag this CVE as exploited in the wild.
Quick check
Were my collection access rules enforced?
Not on the /api/puck endpoints before 0.6.23, according to the advisory.
What is the fixed version?
0.6.23.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
