Description
All /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload’s local API with the default overrideAccess: true, bypassing all collection-level access control. The access option passed to createPuckPlugin() and any access rules defined on Puck-registered collections were silently ignored on these endpoints.
Recommendation
Update the @delmaredigital/payload-puck package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.6.23
- Patched version(s): 0.6.23
References
Could your website be exposed too?
SmartScanner can check your website for @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass - CVE-2026-45577
- StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts - CVE-2026-32106
- Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Ex - CVE-2026-45395
- Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host - CVE-2026-71319
You might also like:
See something that needs correcting? Let us knowUpdated April 08, 2026