CVE-2026-39397: @delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder

This week

CRITICAL 9.4REMOTEUPGRADE

CVE-2026-39397 is a critical-severity flaw (CVSS 9.4) affecting payload-puck. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with the default overrideAccess: true, bypassing all collection-level access control. The access option passed to createPuckPlugin() and any access rules defined on Puck-registered collections were silently ignored on these endpoints. This

Why this priority

Critical severity
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.4 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.4% (top 69%)
CISA exploited list	No
Weakness	CWE-862
Published	2026-04-07
Last modified	2026-07-24

Publisher (CNA): GitHub, Inc. · Vendor: delmaredigital

Last updated 2026-07-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-04-07 21:17 UTCPublished CVE record published
2026-07-24 21:10 UTCUpdated Record last modified

delmaredigital payload-puck UPGRADE

Affected: < 0.6.23

Fixed in: 0.6.23

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls payload-puck

2. UPGRADE to 0.6.23

npm install payload-puck@">=0.6.23"

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-39397?

payload-puck: upgrade to 0.6.23. Exact commands for each OS are on this page.

Is CVE-2026-39397 being exploited?

CVE-2026-39397 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-39397 affect?

CVE-2026-39397 affects payload-puck. Severity is critical (CVSS 9.4). @delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with the default overrideAcces

How urgent is CVE-2026-39397?

Priority 51/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

References

← Back to latest CVEs