{"id":"EUVD-2026-93493","enisaUuid":"46f173b8-7dde-3ca6-981f-51560a87c8dd","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:11:54 PM","dateUpdated":"Oct 6, 2026, 4:28:23 PM","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw\nhttps://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105850\nGHSA-8r29-2mp2-pmrw\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"0cfb37c5-afa7-3aab-a64e-f6f9c9bde0db","product":{"name":"plugin-ecommerce","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"6cf02ed6-c6f4-383d-9235-59cc4c9f292b","product":{"name":"plugin-ecommerce","vendor":{"name":"@payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"6e284837-7197-3de8-8cd1-11a898a75703","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"8fe71551-e014-3c8d-adb8-5d61e14c6a74","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"enisaIdVendor":[{"id":"612455dc-3ec0-38f8-ad67-539a1f59dad3","vendor":{"name":"payloadcms"}},{"id":"d1b3be17-8c6b-3c9d-89da-1ef68a427675","vendor":{"name":"@payloadcms"}}],"enisaIdVulnerability":[{"id":"a5cf0c5f-6b3d-3e29-a6ff-edf212411577","vulnerability":{"id":"GHSA-8r29-2mp2-pmrw","description":"Payload Ecommerce has an order confirmation validation issue","datePublished":"Oct 6, 2026, 4:17:54 PM","dateUpdated":"Oct 6, 2026, 4:17:54 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw\nhttps://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93493\n","aliases":"CVE-2026-105850\nGHSA-8r29-2mp2-pmrw\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ad97f7ce-99f9-3689-8435-4f2d795ec59e","vulnerability":{"id":"CVE-2026-105850","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:11:54 PM","dateUpdated":"Oct 6, 2026, 4:28:23 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw\nhttps://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93493\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Oct 27, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"48dfe333-879e-3b9f-8395-130c83c7bd93","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"4b18522f-2c03-3db1-959f-342f4bcf184d","product":{"name":"plugin-ecommerce","vendor":{"name":"@payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"4ccba668-5e2c-3abe-b0b1-9a842247a222","product":{"name":"plugin-ecommerce","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"f9061494-a85a-3a9e-9626-50c1199eb33a","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"vulnerabilityVendor":[{"id":"579a35e3-3c2b-3cf8-a700-2fe8ae9995d6","vendor":{"name":"payloadcms"}},{"id":"8d6b3644-dd2f-372a-a6af-c9a3705818fa","vendor":{"name":"@payloadcms"}}]}}],"enisaIdAdvisory":[]}