What’s Vulnerable › Vulnerabilities

CVE-2026-105849: Payload: API key disclosure through ordinary document reads

• Severity: high (CVSS 8.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-15
• Weakness: CWE-201

Description

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Affected products

• payloadcms payload: from 3.0.0 before 3.90.0; 4.0.0-canary0, 4.0.0-canary1, 4.0.0-canary10, 4.0.0-canary11, 4.0.0-canary12, 4.0.0-canary13 (+28) — fixed in 3.90.0

How to fix

Upgrade to a fixed version: payloadcms payload 3.90.0. Check the vendor advisory for mitigations.

References

• https://github.com/payloadcms/payload/commit/880d2e900be22cd66a9e939f2b3e702fa413180f
• https://github.com/payloadcms/payload/releases/tag/v3.90.0
• https://github.com/payloadcms/payload/security/advisories/GHSA-238x-w2j9-gwwr

Get alerted when CVE-2026-105849 or the next vulnerability affects your stack