{"id":"GHSA-8r29-2mp2-pmrw","revision":"fd09f72e92794b0fb848c27c82aac38d","records":[{"revision":"fd09f72e92794b0fb848c27c82aac38d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-8r29-2mp2-pmrw","aliases":["CVE-2026-105850"],"title":"Payload Ecommerce has an order confirmation validation issue","description":"## Impact\nWhen using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions.\n\nYou are affected if:\n- You use `@payloadcms/plugin-ecommerce` with the Stripe payment adapter.\n\nDeployments that do not use the Stripe payment flow are not affected.\n\n## Patches\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.\n\n## Workarounds\nEnsure Stripe order confirmations can only be processed once. This is a temporary mitigation; upgrading to a patched version is recommended.","state":0,"publishedAt":"2026-10-06T16:17:54+00:00","modifiedAt":"2026-10-06T16:30:04.326257+00:00","affected":[{"ecosystem":"npm","name":"@payloadcms/plugin-ecommerce","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.90.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@payloadcms/plugin-ecommerce","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0-canary.0"},{"kind":"fixed","version":"4.0.0-canary.34"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw","https://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e","https://github.com/payloadcms/payload","https://github.com/payloadcms/payload/releases/tag/v3.90.0"],"sourceUrl":"https://github.com/advisories/GHSA-8r29-2mp2-pmrw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8r29-2mp2-pmrw","identifiers":["GHSA-8r29-2mp2-pmrw","CVE-2026-105850"]},"retained":false,"historicalAffected":[]}],"coverage":[]}