CVE-2026-105850 in PayloadCMS
Summary
by MITRE • 10/06/2026
Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within Payload CMS involves a critical flaw in the handling of payment confirmations when utilizing the Stripe integration, specifically affecting plugin-ecommerce versions prior to 3.90.0 and canary releases before 4.0.0-canary.34. As an open-source headless content management system widely adopted for building complex web applications, Payload CMS relies on robust integrations with third-party services like Stripe to manage e-commerce transactions securely. The core issue stems from the lack of idempotency checks or insufficient state validation during the processing of webhook events sent by Stripe upon order confirmation. In a typical payment flow, external systems may retry sending confirmation payloads due to network latency, timeouts, or internal retries within the provider's infrastructure. Without proper safeguards, the application processes each incoming payload as a distinct transaction rather than recognizing it as a duplicate of an already completed action.
This technical flaw allows for double-charging customers and creating multiple order records in the database for a single purchase event. From a security perspective, this represents a failure to enforce idempotent operations on state-changing endpoints, which is a common anti-pattern in distributed systems interacting with external APIs. The absence of unique transaction identifiers or proper status checks before processing leads to unintended side effects that compromise data integrity and financial accuracy. Attackers who can manipulate the timing or frequency of webhook deliveries might exploit this race condition to trigger multiple charge events against valid payment methods, resulting in significant revenue loss for merchants and potential disputes with customers whose cards are charged repeatedly without corresponding additional goods delivered.
The operational impact extends beyond immediate financial discrepancies. It introduces inconsistencies into inventory management systems that rely on order creation as a trigger for stock deduction. If an item is reserved or deducted multiple times due to duplicate processing, the system may report incorrect availability levels, leading to overselling scenarios where more items are sold than exist in physical stock. Furthermore, this vulnerability undermines trust in the platform's reliability and security posture, potentially affecting enterprise adoption decisions where strict financial controls and audit trails are mandatory requirements for compliance with standards such as PCI DSS regarding secure transaction processing.
To mitigate this risk, organizations using affected versions must upgrade immediately to payloadcms/plugin-ecommerce version 3.90.0 or later, which includes the necessary logic to detect and discard duplicate webhook events based on Stripe's unique event IDs. For developers implementing custom payment handlers, it is essential to implement idempotency keys at the application level by storing processed event identifiers in a persistent store such as Redis or a database table with unique constraints. This ensures that subsequent attempts to process the same confirmation are ignored after the initial successful execution. Additionally, leveraging Stripe's built-in features for webhook deduplication and ensuring proper error handling during asynchronous processing phases will further harden the integration against race conditions and replay attacks aligned with CWE-362 concurrent execution using shared resources with insufficient synchronization or CWE-841 improper enforcement of transaction idempotency as categorized in standard vulnerability taxonomies.