{"id":"CVE-2026-25574","aliases":["GHSA-jq29-r496-r955"],"url":"https://o3.security/vulnerability/CVE-2026-25574","summary":"Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)","details":"### Impact\n\nA cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the `payload-preferences` internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide.\n\n**Users are affected if ALL of these are true:**\n\n- Multiple auth collections configured (e.g., `admins` + `customers`)\n- Postgres or SQLite database adapter with serial/auto-increment IDs\n- Users in different auth collections with the same numeric ID\n\n**Not affected:**\n\n- `@payloadcms/db-mongodb` adapter\n- Single auth collection environments\n- Postgres/SQLite with `idType: 'uuid'`\n\n### Patches\n\nThis vulnerability has been patched in **v3.74.0**. Users should upgrade to v3.74.0 or later.\n\n### Workarounds\n\nThere is no workaround other than upgrading. Users with multiple auth collections using Postgres or SQLite with serial IDs should upgrade immediately.","published":"2026-02-06T21:04:48.036Z","modified":"2026-08-12T03:51:24.136278275Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"score":0.00201,"percentile":0.1021,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"payload","fixedVersion":"3.74.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25574.json"},{"type":"ADVISORY","url":"https://github.com/payloadcms/payload/security/advisories/GHSA-jq29-r496-r955"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25574"},{"type":"PACKAGE","url":"https://github.com/payloadcms/payload"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:24.136278275Z"}}