How to use this reference
Treat every request-to-server-API adapter as an authority boundary. Explicitly preserve the requesting actor and require the relevant collection policy for both reads and changes. Separate permission to use a feature from permission to act on its underlying data, and distinguish the collections a plugin manages from those a particular caller may access. These are editorial design-review objectives; the presence of a policy definition does not establish that an operation evaluates it.
Before reading
- Authentication versus operation-specific authorization
- Server-side API defaults, caller context and collection access policies
Context and limits
- The issue requires the affected alt-text plugin, an authenticated caller and collection policies that would otherwise deny the requested access. It is not an unauthenticated access claim.
- The advisory reports unauthorized upload-document reads and changes to alt text and keywords; this does not establish unrestricted field writes. Its supplied demonstration uses the real plugin handler with a mocked Payload framework, not a complete deployed stack. Production compromise, account takeover and independent reproduction are not established here.
- The advisory lists plugin versions before 0.8.0 as affected and 0.8.0 as patched. This historical minimum is not a comprehensive current security guarantee.
- The official 0.8.0 release notes describe reads and writes under the requesting user's collection access rules, plus rejection of collections outside plugin management. Release metadata records June 21, 2026 at 11:45:15 UTC; that software-release time is separate from the unknown resource-edition date.
- The advisory credits EQSTLab as Reporter and 232-323 as Finder. jhb-dev is the publishing account, not an explicit article byline, so authors remains empty. No individual award is established by these sources.
Sources and provenance
- Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission jhb-software / Payload plugins · reviewed 2026-10-04
- Payload Local API documentation Payload · reviewed 2026-10-04
- Official alt-text 0.8.0 release notes and metadata jhb-software / Payload plugins via GitHub · reviewed 2026-10-04
Record reviewed 2026-10-04. Snapshot d5550c789111. Open the complete JSON contract.