CVE-2026-59965

CVE-2026-59965 is an authorization bypass (CWE-863) in version 0.7.0 of the npm package @jhb.software/payload-alt-text-plugin, a plugin that adds AI-generated alt-text endpoints to Payload CMS v3 projects. The plugin's POST /api/alt-text-plugin/generate and /bulk endpoints call the Payload Local API (findByID and update) without setting overrideAccess: false, and Payload's internal logic treats an omitted parameter as overriding access, so the collection's read and update access functions are never invoked. As a result, any authenticated user — regardless of role — can read and overwrite the alt and keywords fields on upload documents in any collection, even those protected by restrictive, admin-only access rules. Anyone running a Payload CMS v3 project with the vulnerable plugin version installed is affected, and impact is limited to confidentiality and integrity of these metadata fields (CVSS 7.1, C:L/I:H/A:N). There is no known public proof-of-concept, it is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Check for and upgrade to a release of @jhb.software/payload-alt-text-plugin newer than 0.7.0 once a patched version is published, since the advisory does not name a fixed version. As interim mitigation, restrict which authenticated users can reach /api/alt-text-plugin/generate and /bulk, or treat collection-level read/update access rules on upload collections as not enforced for the alt and keywords fields. Review upload-collection documents for unexpected changes to alt and keywords metadata made by non-admin accounts.