CodeVetter · Repo Unpack · Risk map
payloadcms/payload
These are source observations and explicitly marked hypotheses, not confirmed vulnerabilities. Important review boundaries include privileged API options, development autologin, secret rotation, request rewriting, configuration caches, and filesystem side effects. The inspected code contains protections as well as intentional trusted bypasses. Runtime exploitability, production configuration, and whole-repository test gaps were not established.
- createOperation skips collection create access when overrideAccess is truthy; createLocal defaults it to false. The documented low-level payload.db.batchProcessing method does not run Local API access, hooks, field validation, or upload handling, and leaves transaction lifecycle to its caller.
- JWTAuthentication can return a configured autologin user when no token is present and DisableAutologin is not true; that lookup uses overrideAccess: true and requires an object autologin configuration without prefillOnly.
- Initialization accepts active and previous secrets into a keyring; JWT verification tries every key, then checks authVersion, typed identity references, an auth-enabled local collection, and configured session membership.
- External URL resolution enforces upload policy, HTTP(S), and an allow-list by default, suppresses forwarded headers by default, and checks downloaded size; trusted callers may opt out of requiring an allow-list.
- Hypothesis: file or email side effects may need compensation after later create failures because local uploads and verification email precede commit, while the shown catch path removes temporary files and rolls back the database transaction. (inferred)
- The JSON POST-to-GET override branch appends fallbackLocale using data.depth rather than data.fallbackLocale, and uses '&' even when no locale query was added; this is a source-level discrepancy requiring reproduction, not a confirmed security issue.
- getPayload caches by supplied key or 'default', rather than comparing configuration identity; getGraphql uses one global schema cache outside development. Multiple-config integrations must account for these cache boundaries.
- The root development Next config sets ignoreBuildErrors: true; development Payload initialization can spawn generate:types through a Node child process, and production test-preparation scripts delete/recreate working directories.