Insecure Direct Object Reference in Payload CMS

CVE-2026-25574

What is CVE-2026-25574?

The Insecure Direct Object Reference (IDOR) vulnerability in Payload CMS allows authenticated users within a multi-auth collection to access and manipulate preferences of users from different auth collections due to inadequate access controls. This issue arises when using databases like Postgres or SQLite with default serial or auto-increment IDs, leading to potential exposure of sensitive user data and actions such as deletion of preferences. The vulnerability affects versions prior to 3.74.0 and has been rectified in the latest release, highlighting the importance of maintaining updated software to mitigate such risks.

References