Read the docs
TI-2026-68490 Aliases CVE-2026-105852GHSA-7c34-32v3-j575

Authorization bypass in Payload relationship queries exposes related documents

Priority LOW 36CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Payload, a free and open source headless content management system, is affected in versions before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34. Querying a readable collection that has a relationship to another collection can expose information about related documents that access.read where constraints should protect. An unauthenticated remote attacker can exploit this with low complexity, and the impact is limited to confidentiality. The weakness is classified as CWE-862, Missing Authorization.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00268 19th percentileScored 2026-11-07
Fix Fixed payload (payloadcms): 3.90.0, 4.0.0-canary.34payload (npm): 3.90.0, 4.0.0-canary.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
payloadcmspayloadbefore 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.343.90.0, 4.0.0-canary.34Patch availableCNA
—payload (npm)before 3.90.03.90.0Patch availableGHSA-7c34-32v3-j575
—payload (npm)4.0.0-canary.0 to before 4.0.0-canary.344.0.0-canary.34Patch availableGHSA-7c34-32v3-j575
  • payload Vendorpayloadcms Affected before 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 3.90.0, 4.0.0-canary.34 Patch available CNA
  • payload (npm) Vendor— Affected before 3.90.0 Fixed in 3.90.0 Patch available GHSA-7c34-32v3-j575
  • payload (npm) Vendor— Affected 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 4.0.0-canary.34 Patch available GHSA-7c34-32v3-j575

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*before 3.90.0Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*4.0.0 canary0Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*4.0.0 canary1Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*4.0.0 canary10Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*4.0.0 canary11Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*4.0.0 canary12Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*4.0.0 canary13Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*4.0.0 canary14Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*4.0.0 canary15Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*4.0.0 canary16Vulnerablepayloadcms
  • cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* Versions before 3.90.0 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:* Versions 4.0.0 canary0 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:* Versions 4.0.0 canary1 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:* Versions 4.0.0 canary10 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:* Versions 4.0.0 canary11 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:* Versions 4.0.0 canary12 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:* Versions 4.0.0 canary13 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:* Versions 4.0.0 canary14 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:* Versions 4.0.0 canary15 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:* Versions 4.0.0 canary16 Vulnerable ·payloadcms
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*4.0.0 canary17Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*4.0.0 canary18Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*4.0.0 canary19Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*4.0.0 canary2Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*4.0.0 canary20Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*4.0.0 canary21Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*4.0.0 canary22Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*4.0.0 canary23Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*4.0.0 canary24Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*4.0.0 canary25Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*4.0.0 canary26Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*4.0.0 canary27Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*4.0.0 canary28Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*4.0.0 canary29Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*4.0.0 canary3Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*4.0.0 canary30Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*4.0.0 canary31Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*4.0.0 canary32Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*4.0.0 canary33Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*4.0.0 canary4Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*4.0.0 canary5Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*4.0.0 canary6Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*4.0.0 canary7Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*4.0.0 canary8Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*4.0.0 canary9Vulnerablepayloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:* Versions 4.0.0 canary17 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:* Versions 4.0.0 canary18 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:* Versions 4.0.0 canary19 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:* Versions 4.0.0 canary2 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:* Versions 4.0.0 canary20 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:* Versions 4.0.0 canary21 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:* Versions 4.0.0 canary22 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:* Versions 4.0.0 canary23 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:* Versions 4.0.0 canary24 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:* Versions 4.0.0 canary25 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:* Versions 4.0.0 canary26 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:* Versions 4.0.0 canary27 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:* Versions 4.0.0 canary28 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:* Versions 4.0.0 canary29 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:* Versions 4.0.0 canary3 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:* Versions 4.0.0 canary30 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:* Versions 4.0.0 canary31 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:* Versions 4.0.0 canary32 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:* Versions 4.0.0 canary33 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:* Versions 4.0.0 canary4 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:* Versions 4.0.0 canary5 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:* Versions 4.0.0 canary6 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:* Versions 4.0.0 canary7 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:* Versions 4.0.0 canary8 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:* Versions 4.0.0 canary9 Vulnerable ·payloadcms

Remediation

Upgrade the npm package payload to version 3.90.0 or 4.0.0-canary.34. The sources list no fixed version for payloadcms payload.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA payload (payloadcms) Fixed in 3.90.0, 4.0.0-canary.34
  • Fix · GHSA-7c34-32v3-j575 payload (npm) Fixed in 3.90.0 Advisory →
  • Fix · GHSA-7c34-32v3-j575 payload (npm) Fixed in 4.0.0-canary.34 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105852
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-06 Priority changed: MEDIUM → LOW
  4. 2026-10-06 Alias added: GHSA-7c34-32v3-j575
  5. 2026-10-06 Fix available: npm/[email protected], npm/[email protected] · GHSA-7c34-32v3-j575
  6. 2026-10-06 CVSS score added · GHSA-7c34-32v3-j575
  7. 2026-10-06 Weakness changed · GHSA-7c34-32v3-j575
  8. 2026-10-06 4 new references · GHSA-7c34-32v3-j575
  9. 2026-10-15 CVSS score added · NVD

References

Patch 2

Advisory 1

Other 1

  • TI-2026-20653 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68608 Payload CMS lets attackers update collection documents CVSS 3.1CRITICAL 9.8
  • TI-2026-68606 Remote code execution in Payload Form Builder plugin CVSS 3.1CRITICAL 10.0
  • TI-2026-68612 Payload authentication token field handling issue CVSS 4.0CRITICAL 9.2
  • TI-2026-26995 Payload has Unvalidated Input in Password Recovery Endpoints CVSS 3.1CRITICAL 9.1
  • TI-2026-68489 Field access control bypass in Payload duplicate operation CVSS 4.0CRITICAL 9.3
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences