CVE-2026-105850: CWE-837: Improper Enforcement of a Single, Unique Action in payloadcms payload
Description
## Impact When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions. You are affected if: - You use `@payloadcms/plugin-ecommerce` with the Stripe payment adapter. Deployments that do not use the Stripe payment flow are not affected. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ## Workarounds Ensure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.
CVSS v4.0
Score 8.8high
Affected software
payloadcms
payload
@payloadcms
plugin-ecommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PayloadCMS, a headless content management system, has a vulnerability identified as CVE-2026-105850 (CWE-837) affecting the @payloadcms/plugin-ecommerce Stripe payment adapter. In affected versions prior to 3.90.0 and canary versions before 4.0.0-canary.34, the system may process a Stripe order confirmation more than once under certain conditions, violating the enforcement of a single unique action. This could result in duplicate processing of orders. The vulnerability has a CVSS 4.0 score of 8.8, indicating high severity. The issue is resolved in versions 3.90.0 and 4.0.0-canary.34.
Potential Impact
The vulnerability allows multiple processing of a single Stripe order confirmation, potentially leading to duplicate orders or transactions. This can cause financial discrepancies and operational issues for merchants using the affected versions of PayloadCMS with the Stripe payment adapter.
Mitigation Recommendations
Upgrade to PayloadCMS version 3.90.0 or later, or to canary version 4.0.0-canary.34 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-05T23:06:29.748Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac51f772cdf04f656c32845
Added to database: 10/06/2026, 16:19:03 UTC
Last enriched: 10/06/2026, 16:33:22 UTC
Last updated: 10/06/2026, 21:42:11 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.