@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass

Published September 10, 2026 CVE-2026-59965

Payload's alt-text plugin lets any signed-in user read protected media details and change image descriptions and keywords. This can bypass role restrictions on upload collections.

Severity
HighCVSS 3.1 · 7.1 · github.com
Affected versions
0.7.0 or older
Weakness
CWE-863Incorrect Authorization
Affects
@jhb.software/payload-alt-text-plugin

How it works

  • The plugin accepts requests from any signed-in session.
  • It accepts the target collection, document, language, and update choice from the request.
  • Its document reads and updates omit the setting that enforces collection access rules.
  • As a result, a low-privilege account can read protected upload records and change their alt and keywords fields.

What to do

Run npm list @jhb.software/payload-alt-text-plugin in each Payload project. Compare the installed version with the advisory's affected range, 0.7.0 or older, and check whether the plugin is enabled.

Run this in the application environment you want to check:

npm list @jhb.software/payload-alt-text-plugin

Review the GitHub advisory for the vendor's documented fix or mitigation before continuing to use affected releases.

Technical details

Affected software: @jhb.software/payload-alt-text-plugin

CVE-2026-59965 is an authorization bypass in the plugin's custom alt-text endpoints. The endpoints use Payload's internal API without enforcing collection-level read and update rules.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact Low Some data can be read
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Open in FIRST.org calculator

References

View Original Source