Disclosure summary
## Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. **You are affected if ALL of these are true:** - Your application uses `@payloadcms/plugin-stripe`. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy. Deployments that do not enable the Stripe REST proxy are not affected. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ## Workarounds Upgrading to a patched version is recommended. If you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-r9v2-gg2j-22q5
Open original source · Updated Oct 06, 2026
Payload: Insufficient Access Control in Stripe REST Proxy
Source severity: MEDIUM / 6.4
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | @payloadcms/plugin-stripe | < 3.90.0 | 3.90.0 |
| npm | @payloadcms/plugin-stripe | >= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-10-06T12:09:46-04:00
MODIFIED 2026-10-06T12:09:48-04:00
INGESTED 2026-10-08T12:05:11-04:00