@delmaredigital/payload-puck is a PayloadCMS plugin that, prior to version 0.6.23, allowed any user to invoke its /api/puck/* CRUD endpoints. The default overrideAccess:true setting bypassed all collection‑level access control, meaning an attacker could read, create, update or delete content in any Puck‑registered collection without authentication. This flaw directly compromises data confidentiality, integrity and availability within the affected CMS instance.

The vulnerability impacts installations of the delmaredigital:payload-puck plugin on any PayloadCMS site that use a version earlier than 0.6.23. No other vendors or product versions are reported as affected.

With a CVSS score of 9.4 the flaw is considered critical. External Probability of Success (EPSS) is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based API request to /api/puck/* endpoints, which can be performed by any party without credentials. Exploitation requires the plugin to be present and running on a PayloadCMS instance that has not been patched to 0.6.23.