What is GHSA-r9v2-gg2j-22q5?

GHSA-r9v2-gg2j-22q5 is a security advisory published by GitHub Security Advisories with Medium severity. Payload: Insufficient Access Control in Stripe REST Proxy

Which CVE IDs does GHSA-r9v2-gg2j-22q5 cover?

GHSA-r9v2-gg2j-22q5 covers the following CVE IDs: CVE-2026-105848. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-r9v2-gg2j-22q5?

GHSA-r9v2-gg2j-22q5 affects 2 products, including: npm/@payloadcms/plugin-stripe:\u003c 3.90.0; npm/@payloadcms/plugin-stripe:\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.34.

GHSA-r9v2-gg2j-22q5Medium

Payload: Insufficient Access Control in Stripe REST Proxy

Vendor

GitHub Security Advisories

Published

October 6, 2026

Last Modified

October 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-105848 →

📋 Description

Impact

An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy.

You are affected if ALL of these are true:

Your application uses @payloadcms/plugin-stripe.
The optional Stripe REST proxy is enabled.
An authenticated user can reach the proxy.

Deployments that do not enable the Stripe REST proxy are not affected.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Upgrading to a patched version is recommended.

If you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.

🎯 Affected products2

npm/@payloadcms/plugin-stripe:< 3.90.0
npm/@payloadcms/plugin-stripe:>= 4.0.0-canary.0, < 4.0.0-canary.34