# CVE-2026-105850: Payload Ecommerce has an order confirmation validation issue

> CVE-2026-105850 (GitHub advisory GHSA-8r29-2mp2-pmrw) is a high-severity vulnerability with a CVSS 4.0 base score of 8.8, classed as Improper Enforcement of a Single, Unique Action (CWE-837), in @payloadcms/plugin-ecommerce (npm). Affected versions: < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34. It is fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-105850

| Field | Value |
| --- | --- |
| CVE | CVE-2026-105850 |
| GHSA | GHSA-8r29-2mp2-pmrw |
| Severity | High |
| CVSS 4.0 | 8.8 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N` (GitHub Advisory Database) |
| CWE | CWE-837 Improper Enforcement of a Single, Unique Action |
| EPSS | 0.3% (higher than 21% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable yes, technical impact partial |
| Published | 6 Oct 2026 |
| Modified | 6 Oct 2026 |

## Description

#### Impact
When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions.

You are affected if:
- You use `@payloadcms/plugin-ecommerce` with the Stripe payment adapter.

Deployments that do not use the Stripe payment flow are not affected.

#### Patches
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

#### Workarounds
Ensure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| @payloadcms/plugin-ecommerce | npm | `pkg:npm/%40payloadcms/plugin-ecommerce` | < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 | 3.90.0, 4.0.0-canary.34 |

## Fix commits

- Patch: https://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e
- Release: https://github.com/payloadcms/payload/commit/e10b60228b92b680663110ea2af431643bfc6126 (3.90.0)

## Questions

**What is the GHSA ID for CVE-2026-105850?**

GitHub tracks CVE-2026-105850 as GHSA-8r29-2mp2-pmrw.

**What is the CVSS score of CVE-2026-105850?**

CVE-2026-105850 has a CVSS 4.0 base score of 8.8 (High), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N.

**Which versions are affected by CVE-2026-105850?**

@payloadcms/plugin-ecommerce (npm): < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34.

**How do I fix CVE-2026-105850?**

Upgrade to 3.90.0 or 4.0.0-canary.34, depending on the release line. The fix is in commit 6c0c4dc.

**What is the Package URL (PURL) for CVE-2026-105850?**

The affected package's PURL is pkg:npm/%40payloadcms/plugin-ecommerce.

**Is CVE-2026-105850 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-105850. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.3% chance of exploitation in the next 30 days, higher than 21% of CVEs.

## References

- https://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e (fix)
- https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105850.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2026-105850 (advisory)
- https://github.com/advisories/GHSA-8r29-2mp2-pmrw (advisory)
- https://github.com/payloadcms/payload (package)
- https://github.com/payloadcms/payload/releases/tag/v3.90.0

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-105850), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.