Skip to content
CVE IDCVE-2026-105850GitHub advisory IDGHSA-8r29-2mp2-pmrw

Payload Ecommerce has an order confirmation validation issue

CVE-2026-105850 (GitHub advisory GHSA-8r29-2mp2-pmrw) is a high-severity vulnerability with a CVSS 4.0 base score of 8.8, classed as Improper Enforcement of a Single, Unique Action (CWE-837), in @payloadcms/plugin-ecommerce (npm). Affected versions: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34. It is fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line.

High8.8Fix availableGitHub reviewed

Published 6 Oct 2026Updated 6 Oct 2026

8.8HighCVSS 4.0
CVE ID
CVE-2026-105850
GHSA ID
GHSA-8r29-2mp2-pmrw
EPSS
0.3%higher than 21% of CVEs
Weakness (CWE)
  • CWE-837Improper Enforcement of a Single, Unique Action
KEV status
Not in KEV
Published
6 Oct 2026
Updated
6 Oct 2026
Ecosystem
  • npm
Assigned by (CNA)
GitHub_M

Summary

Source: OSV (GitHub advisory)

Impact

When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions.

You are affected if:

  • You use @payloadcms/plugin-ecommerce with the Stripe payment adapter.

Deployments that do not use the Stripe payment flow are not affected.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Ensure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.

Technical details

Source: GitHub Advisory Database

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

High8.8Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Attack Requirements AT
None
Privileges Required PR
None
User Interaction UI
None
Confidentiality (Vulnerable System) VC
None
Integrity (Vulnerable System) VI
High
Availability (Vulnerable System) VA
High
Confidentiality (Subsequent Systems) SC
None
Integrity (Subsequent Systems) SI
None
Availability (Subsequent Systems) SA
None

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
yes
Attackers can automate this at scale
Technical impact
partial
Limited control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • @payloadcms/plugin-ecommerce
    npm
    pkg:npm/%40payloadcms/plugin-ecommerce
    Affected versions
    < 3.90.0
    >= 4.0.0-canary.0, < 4.0.0-canary.34
    Fixed in
    3.90.0
    4.0.0-canary.34

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 3.90.0 or 4.0.0-canary.34, depending on your release line.

Patch commits

  • 6c0c4dcPatch commitgithub.com/payloadcms/payload

    fix(plugin-ecommerce)!: prevent Stripe settlement replay

    +2303 −293 across 16 files

    • docs/ecommerce/payments.mdx+39 −44
    • packages/plugin-ecommerce/README.md+6 −0
    • packages/plugin-ecommerce/src/collections/orders/createOrdersCollection.spec.ts+31 −0
    • packages/plugin-ecommerce/src/endpoints/confirmOrder.spec.ts+547 −0
    • packages/plugin-ecommerce/src/endpoints/confirmOrder.ts+414 −46
    • packages/plugin-ecommerce/src/fields/statusField.spec.ts+11 −0
    • packages/plugin-ecommerce/src/fields/statusField.ts+5 −0
    • packages/plugin-ecommerce/src/index.ts+1 −0
    • and 8 more files

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • e10b602Release commit3.90.0github.com/payloadcms/payload

Vulnerability intelligence

References

Questions about CVE-2026-105850

What is the GHSA ID for CVE-2026-105850?
GitHub tracks CVE-2026-105850 as GHSA-8r29-2mp2-pmrw.
What is the CVSS score of CVE-2026-105850?
CVE-2026-105850 has a CVSS 4.0 base score of 8.8 (High), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N.
Which versions are affected by CVE-2026-105850?
@payloadcms/plugin-ecommerce (npm): < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34.
How do I fix CVE-2026-105850?
Upgrade to 3.90.0 or 4.0.0-canary.34, depending on the release line. The fix is in commit 6c0c4dc.
What is the Package URL (PURL) for CVE-2026-105850?
The affected package's PURL is pkg:npm/%40payloadcms/plugin-ecommerce.
Is CVE-2026-105850 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-105850. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.3% chance of exploitation in the next 30 days, higher than 21% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 2 days ago (13 Oct 2026, 12:59 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.