Information Exposure in Payload CMS by Payload
CVE-2026-105805
6.9MEDIUM
What is CVE-2026-105805?
In Payload CMS, prior to version 3.88.0 and canary version 4.0.0-canary.27, an untrusted user can exploit the ability to query a readable collection, manipulate its sorting, and select a protected field as the sort parameter. This manipulation can lead to the inference of sensitive information about field values that the user should not have access to, posing a risk to data confidentiality. Users are encouraged to update to the latest versions to mitigate the risk.
Affected Version(s)
payload < 3.88.0 < 3.88.0
payload >= 4.0.0-canary.0, < 4.0.0-canary.27 < 4.0.0-canary.0, 4.0.0-canary.27