CVE-2026-58200

The @jhb.software/payload-cloudinary-plugin (part of the Payload Plugins collection for Payload CMS), from 0.3.0 until 0.4.0, exposes a POST /api/cloudinary-generate-signature endpoint that signs attacker-supplied paramsToSign values with the server's Cloudinary HMAC-SHA1 secret without any parameter allowlist, collection policy, timestamp freshness check, or folder enforcement. Any authenticated Payload user can trigger this endpoint to obtain valid signatures for unauthorized Cloudinary parameters such as overwrite, type, notification_url, invalidate, folder, and public_id. With these signatures, an attacker can replace existing assets, change upload visibility (e.g., to unsigned/public types), register attacker-controlled callback URLs, invalidate CDN caches, and upload outside the intended folder — resulting in high integrity impact and low availability impact per the CVSS 7.1 rating. Affected parties are Payload CMS deployments running the plugin with clientUploads enabled in the stated version range. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so exploitation status is none known.

What to do: Upgrade @jhb.software/payload-cloudinary-plugin to 0.4.0 or later, which enforces signing restrictions. If immediate upgrade is not possible, disable clientUploads or restrict access to the /api/cloudinary-generate-signature endpoint to trusted roles only. Review Cloudinary logs and asset history for unexpected overwrites, folder changes, or notification_url callbacks, and rotate Cloudinary credentials if misuse is suspected.