high · 7.1CVE-2026-59965Sep 10, 2026

CVE-2026-59965: @jhb.software/payload-alt-text-plugin Authorization Bypass via overrideAccess Omission

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A missing overrideAccess: false flag in the plugin's Payload Local API calls lets any logged-in user read and overwrite alt text and keyword fields on upload documents that should be restricted to…

Package@jhb.software/payload-alt-text-plugin
Ecosystemnpm
Affected<= 0.7.0
CVE-2026-59965: @jhb.software/payload-alt-text-plugin Authorization Bypass via overrideAccess Omission

The problem

The plugin registers two REST endpoints, POST /api/alt-text-plugin/generate and /bulk, whose handler functions call Payload's Local API (findByID and update) without setting overrideAccess: false.

Payload evaluates shouldOverrideAccess = overrideAccess !== false, so omitting the parameter silently defaults to true, and collection-level access functions are never called. Any authenticated session, regardless of role, can read and overwrite the alt and keywords fields on arbitrary upload documents.

Proof of concept

A working proof-of-concept for CVE-2026-59965 in @jhb.software/payload-alt-text-plugin, with the exact payload below.

bash
curl -i -b "payload-token=<LOW_PRIV_TOKEN>" \
  -H "Content-Type: application/json" \
  -X POST http://localhost:3000/api/alt-text-plugin/generate \
  --data '{"collection":"media","id":"doc-001","locale":"en","update":true}'

The root cause is in generateAltText.ts (lines 31 and 121) and bulkGenerateAltTexts.ts (lines 120 and 170). Both files omit overrideAccess: false and the req object from their payload.findByID and payload.update calls.

Because Payload's internal check is shouldOverrideAccess = overrideAccess !== false, passing nothing evaluates undefined !== false as true, bypassing every collection access rule. The fix is mechanical: add overrideAccess: false and forward req to each Local API call so Payload evaluates the real user's permissions.

A direct Local API call with overrideAccess: false by the same low-privilege user correctly throws AccessError, proving the collection access rules are sound and the plugin endpoint is the sole bypass vector (CWE-863).

The fix

Upgrade to @jhb.software/payload-alt-text-plugin v0.8.0 or later. The patch adds overrideAccess: false and req to every findByID and update call inside generateAltText.ts and bulkGenerateAltTexts.ts. No configuration changes are needed after upgrading.

Reporter not attributed.

References: [1][2]

Related research