CVE-2026-39397

The CVE affects the @delmaredigital/payload-puck PayloadCMS plugin (prior to 0.6.23). The /api/puck/* CRUD endpoints registered by createPuckPlugin() bypassed collection-level access controls due to overrideAccess: true, allowing unauthenticated access to Puck-registered collections. Fixed in 0.6...