GitHub Advisoryadvisory · npm

GHSA-fpww-c55p-cjv6 Payload: Polymorphic join queries could disclose hidden fields

HIGH Published 2026-10-06 Modified 2026-10-06 Official page ↗
Aliases
CVE-2026-105847
Ecosystem
npm
Packages
payload
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-200, CWE-639
Reviewed
2026-10-06

Affected packages

• npm payload: >= 3.0.0, < 3.90.0 → fixed in 3.90.0 • npm payload: >= 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34

Description

Impact A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens. You are affected if: • You use an affected Payload version. • Users can query a collection with a polymorphic join to sensitive fields. Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. Workarounds There is no complete workaround. Restricting read access to sensitive collections reduces exposure but does not replace upgrading.

Related

Alias · CVE (1)

  • CVE-2026-105847 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References