Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

PayloadCMS/payload

              main @ 72ee175
            

176

Fixes

CVEs

CRITICAL

Peak severity

31.3%

Coverage

Highlights

Auth Bypass: 80 prior fixes. Scrutinize any change in this area.

packages/payload/src/config/createClientConfig.ts: most-fixed (6 issues). Treat as high-risk during review.

133 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple critical and high-severity fixes show that admin views and server functions repeatedly failed to enforce access control, allowing unauthenticated or unauthorized users to access admin routes, view versions, and trigger operations. The pattern of adding overrideAccess:false and canAccessAdmin checks indicates a systemic gap where data-access calls default to insecure behavior.

Access Control Bypass: MCP tools, file access checks, and multi-tenant filters each had bypasses where access control was either skipped (overrideAccess:true), not applied to all paths (e.g., staticHandler), or used incorrect identity/tenant data. These fixes highlight the need for consistent, server-side enforcement across all API surfaces and plugins.

SSRF: SSRF protections were repeatedly bypassed due to DNS rebinding, automatic redirects, and lack of IP allowlist enforcement. The fixes show that a single safeFetch with DNS-level IP validation and manual redirect re-validation is required, and that all external file fetching paths must use it consistently.