CVE-2026-105805 in Payload
Summary
by MITRE • 10/06/2026
Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
Payload CMS contains an information disclosure vulnerability affecting versions prior to 3.88.0 and canary releases before 4.0.0-canary.27, which allows authenticated users with access to readable collections to infer sensitive data about protected fields through a timing-based side-channel attack. The core technical flaw lies in the sorting mechanism of the database query layer, where an attacker who possesses read permissions for a specific collection can manipulate the sort parameter by selecting a field that is otherwise restricted from direct retrieval due to role-based access controls or schema-level protections. By controlling how results are ordered and observing the response time variations associated with different sort keys, the attacker can deduce the values of these protected fields without ever receiving them in the API response payload itself. This technique exploits the fact that database sorting operations often involve comparisons that take varying amounts of time depending on the data being processed or indexed, creating a measurable timing difference that correlates with specific field values.
This vulnerability is classified under CWE-209 as an Information Exposure Through Timing Discrepancy and aligns with MITRE ATT&CK technique T1530, which covers Data from Cloud Storage Objects when applied to cloud-based CMS environments, or more broadly T1074 for Data Staged if the inferred data is used in subsequent attacks. The operational impact of this flaw extends beyond simple privacy violations; it undermines the integrity of access control models by allowing unauthorized inference of sensitive attributes such as internal identifiers, status flags, or confidential metadata that were explicitly hidden from certain user roles. In enterprise deployments where Payload CMS manages critical business content, this could lead to competitive intelligence leaks, regulatory compliance failures under frameworks like GDPR or HIPAA if personal data is inferred, and potential escalation paths for further exploitation by combining the inferred data with other known system parameters.
The root cause stems from insufficient abstraction between user-supplied sort inputs and the underlying database engine's execution plan optimization, where protected fields are still utilized in sorting logic despite being excluded from output projections. To mitigate this risk, organizations must upgrade to Payload CMS version 3.88.0 or later, which implements strict validation of sort parameters against an allowlist of publicly accessible fields only, thereby preventing the use of restricted columns in ORDER BY clauses regardless of user input. Additionally, administrators should implement rate limiting on query endpoints and introduce randomized delays in response generation for sorting operations to neutralize timing-based inference attacks as a defense-in-depth measure. Regular security audits focusing on API endpoint permissions and database query construction practices are recommended to ensure that access control policies remain robust against indirect data leakage vectors.