Read the docs
TI-2026-68476 Aliases CVE-2026-105805GHSA-9g87-32v6-3c2r

Sort queries in Payload CMS could expose protected field information

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-863.

Summary

Payload, a headless content management system, is affected in versions before 3.88.0 and in canary versions before 4.0.0-canary.27. Incorrect authorization (CWE-863) lets a sort query expose a protected field. An untrusted user who can query a readable collection and control its sorting can infer limited information about field values they cannot read.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00276 20th percentileScored 2026-11-07
Fix Fixed payload (payloadcms): 3.88.0, 4.0.0-canary.27payload (npm): 3.88.0, 4.0.0-canary.27

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
payloadcmspayloadbefore 3.88.0; 4.0.0-canary.0 to before 4.0.0-canary.273.88.0, 4.0.0-canary.27Patch availableCNA
—payload (npm)before 3.88.03.88.0Patch availableGHSA-9g87-32v6-3c2r
—payload (npm)4.0.0-canary.0 to before 4.0.0-canary.274.0.0-canary.27Patch availableGHSA-9g87-32v6-3c2r
  • payload Vendorpayloadcms Affected before 3.88.0; 4.0.0-canary.0 to before 4.0.0-canary.27 Fixed in 3.88.0, 4.0.0-canary.27 Patch available CNA
  • payload (npm) Vendor— Affected before 3.88.0 Fixed in 3.88.0 Patch available GHSA-9g87-32v6-3c2r
  • payload (npm) Vendor— Affected 4.0.0-canary.0 to before 4.0.0-canary.27 Fixed in 4.0.0-canary.27 Patch available GHSA-9g87-32v6-3c2r

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:*:*:*:*:*:*:*:*——payloadcms
  • cpe:2.3:a:payloadcms:payload:*:*:*:*:*:*:*:* Versions — — ·payloadcms

Remediation

Update Payload to 3.88.0 or to 4.0.0-canary.27, the fixed canary version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA payload (payloadcms) Fixed in 3.88.0, 4.0.0-canary.27
  • Fix · GHSA-9g87-32v6-3c2r payload (npm) Fixed in 3.88.0 Advisory →
  • Fix · GHSA-9g87-32v6-3c2r payload (npm) Fixed in 4.0.0-canary.27 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105805
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-06 Priority changed: MEDIUM → LOW
  4. 2026-10-06 Alias added: GHSA-9g87-32v6-3c2r
  5. 2026-10-06 Fix available: npm/[email protected], npm/[email protected] · GHSA-9g87-32v6-3c2r
  6. 2026-10-06 CVSS score added · GHSA-9g87-32v6-3c2r
  7. 2026-10-06 Weakness changed · GHSA-9g87-32v6-3c2r
  8. 2026-10-06 4 new references · GHSA-9g87-32v6-3c2r

References

Other 4

  • TI-2026-10166 PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access CVSS 4.0MEDIUM 5.3
  • TI-2026-20653 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68608 Payload CMS lets attackers update collection documents CVSS 3.1CRITICAL 9.8
  • TI-2026-68606 Remote code execution in Payload Form Builder plugin CVSS 3.1CRITICAL 10.0
  • TI-2026-68480 SQL injection in Payload SQLite and Postgres adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68479 Prototype pollution in Payload Import Export plugin CVSS 4.0CRITICAL 9.3
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences