CVE-2026-39397 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Vulnerability Essence**: The CRUD interfaces in payload-puck < 0.6.23 lack **collection-level access control**. 💥 **Consequence**: Any user can bypass permissions to read and write sensitive data.

Q: Root Cause? (CWE/Flaw)

🔍 **Root Cause**: Missing access control logic ➜ User permissions are not verified. 📌 Corresponding **CWE**: Missing Authorization (e.g., CWE-862).

Q: Who is affected? (Versions/Components)

🎯 **Affected Versions**: payload-puck **< 0.6.23**. 🧩 **Component**: A **visual page building plugin** open-sourced by Delmare Digital.

Q: What can hackers do? (Privileges/Data)

👤 **Attacker Capability**: No login required ➜ Directly access/modify data in any collection. 📂 **Affected Data**: All business data managed by the plugin 🚨.

Q: Is exploitation threshold high? (Auth/Config)

🟢 **Low Exploitation Barrier**: - ✅ **No authentication required** (PR:N) - ✅ **Vulnerable by default configuration**

Q: Is there a public Exp? (PoC/Wild Exploitation)

❌ **No Public Exploit**: - PoC list is empty 📭 - No known in-the-wild exploitation 🕵️

Q: How to self-check? (Features/Scanning)

🔎 **Self-Check Method**: - Check if version < 0.6.23 ⚠️ - Verify if CRUD interfaces lack permission checks 🛠️ - Capture packets to verify unauthorized access to collection data

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Officially Fixed**: - Commit `9148201` submitted 🛡️ - Update to version ≥ 0.6.23 to resolve

Q: What if no patch? (Workaround)

⚠️ **Pre-Patch Mitigation**: - Restrict source IPs for CRUD interfaces 🚧 - Add an authentication layer via reverse proxy 🔐 - Disable unnecessary collection exposure

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority: High**! - CVSS 8.2 🚨 - Easy to exploit + High impact ➜ Upgrade or apply protection immediately 💡

Updated Apr 29, 2026 CVSS 9.4 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Vulnerability Essence**: The CRUD interfaces in payload-puck < 0.6.23 lack **collection-level access control**.  
💥 **Consequence**: Any user can bypass permissions to read and write sensitive data.

Q2Root Cause? (CWE/Flaw)

🔍 **Root Cause**: Missing access control logic ➜ User permissions are not verified.  
📌 Corresponding **CWE**: Missing Authorization (e.g., CWE-862).

Q3Who is affected? (Versions/Components)

🎯 **Affected Versions**: payload-puck **< 0.6.23**.  
🧩 **Component**: A **visual page building plugin** open-sourced by Delmare Digital.

Q4What can hackers do? (Privileges/Data)

👤 **Attacker Capability**: No login required ➜ Directly access/modify data in any collection.  
📂 **Affected Data**: All business data managed by the plugin 🚨.

Q5Is exploitation threshold high? (Auth/Config)

🟢 **Low Exploitation Barrier**:  
- ✅ **No authentication required** (PR:N)  
- ✅ **Vulnerable by default configuration**

Q6Is there a public Exp? (PoC/Wild Exploitation)

❌ **No Public Exploit**:  
- PoC list is empty 📭  
- No known in-the-wild exploitation 🕵️

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check Method**:  
- Check if version < 0.6.23 ⚠️  
- Verify if CRUD interfaces lack permission checks 🛠️  
- Capture packets to verify unauthorized access to collection data

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Officially Fixed**:  
- Commit `9148201` submitted 🛡️  
- Update to version ≥ 0.6.23 to resolve

Q9What if no patch? (Workaround)

⚠️ **Pre-Patch Mitigation**:  
- Restrict source IPs for CRUD interfaces 🚧  
- Add an authentication layer via reverse proxy 🔐  
- Disable unnecessary collection exposure

Q10Is it urgent? (Priority Suggestion)

🔥 **Priority: High**!  
- CVSS 8.2 🚨  
- Easy to exploit + High impact ➜ Upgrade or apply protection immediately 💡

Continue exploring

Vulnerability detail Full AI analysis (login) delmaredigital CWE-862