Prior to version 3.74.0, Payload CMS allows an authorized user to read or delete preference data belonging to users from a different authentication collection when numeric IDs collide. This insecure direct object reference (IDOR) flaw can expose sensitive configuration data and enable destructive actions such as preference deletion. The weakness is classified as CWE-639: Authorization Bypass Through User-Controlled Key.

Affected products include Payload CMS version 3.73.x and earlier. The vulnerability is present when the system operates in a multi‑auth environment with Postgres or SQLite databases that use default auto‑increment primary keys. Users from distinct authentication collections whose numeric identifiers overlap can exploit the flaw.

The issue carries a CVSS base score of 5.4, indicating moderate risk, and the EPSS score is very low, under 1%, suggesting current exploitation attempts are unlikely. The flaw is not listed in CISA’s KEV catalog, and no public exploits are known. Attack requires an authenticated user who can identify that a numeric ID collision exists between preference entries in different authentication collections; based on the description, it is inferred that the attacker would need to enumerate or otherwise discover the overlapping IDs before being able to fetch or delete the other users’ preferences through the internal collection API.