Mmastodon TechnologyCybersecurity first seen 13 h ago, last 13 h ago, peak #12

Access control flaw disclosed in Payload Stripe plugin

Original: 🚨 EUVD-2026-93490 📊 Score: 6.4/10 (CVSS v3.1) 📦 Product: payload, plugin-stripe, plugin-stripe (+1 more) 🏢 Vendor: @payl

A medium-severity vulnerability, EUVD-2026-93490, has been listed in the European vulnerability database affecting Payload CMS's Stripe plugin. Scored 6.4 out of 10 under CVSS v3.1, the flaw involves insufficient access control in the Stripe REST proxy, potentially allowing unauthorized access to Stripe-related functionality. The listing was updated on 6 October 2026, and administrators running Payload with the Stripe plugin are advised to check for patches.

Why now: Security teams are monitoring the newly published vulnerability advisory for the widely used Payload CMS Stripe plugin.

Payload CMSStripeENISA

Open on mastodon →

Evidence

• 🚨 EUVD-2026-93490 📊 Score: 6.4/10 (CVSS v3.1) 📦 Product: payload, plugin-stripe, plugin-stripe (+1 more) 🏢 Vendor: @payloadcms, payloadcms 📅 Updated: 2026-10-06 📝 Payload: Insufficient Access Control in Stripe REST Proxy 🔗 https:// euvd.enisa.europa.eu/vulnerabi… · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/1264925