THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-4qpv-39hg-f7fx (high) — @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

[GHSA] GHSA-4qpv-39hg-f7fx (high) — @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

medgithub_advisoriesPublished 2026-09-10

GHSA-4qpv-39hg-f7fx Severity: high CVE: CVE-2026-59965

@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

## Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

### Summary

`@jhb.software/payload-alt-text-plugin` v0.7.0 exposes custom Payload CMS endpoints (`POST /api/alt-text-plugin/g

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-59965cve

Original source: https://github.com/advisories/GHSA-4qpv-39hg-f7fx