CVE-2026-105847 in Payload
Summary
by MITRE • 10/06/2026
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
Payload CMS contains a critical information disclosure vulnerability affecting version ranges from 3.0.0 up to but not including 3.90.0, as well as canary versions prior to 4.0.0-canary.34. This flaw stems from an improper implementation of access control mechanisms when handling polymorphic joins within the query interface. In a typical content management system architecture, collections often maintain relationships with other data entities through foreign keys or join tables. When these relationships are defined as polymorphic, allowing a single field to reference multiple different collection types, the underlying database queries must strictly enforce row-level security and field-level permissions for every referenced entity. However, in the affected versions of Payload CMS, the query engine fails to adequately restrict access when constructing joins that traverse into sensitive fields of related collections.
The technical root cause lies in how polymorphic join filters are processed during data retrieval operations. An authenticated user with permission to query a primary collection can construct specific filter parameters that trigger database joins against secondary or tertiary tables containing highly sensitive information. Because the system does not sufficiently validate whether the requesting user has explicit read access to every field involved in the joined result set, it returns aggregated data that includes fields which should have been hidden due to role-based restrictions. This bypasses the intended security boundaries established by the application's permission model, effectively allowing lower-privileged users to infer or directly extract values protected from standard queries.
The operational impact of this vulnerability is severe, primarily categorized as an unauthorized information disclosure leading to potential credential compromise and privacy violations. Attackers can exploit this flaw to read-restricted fields such as password-reset tokens, session secrets, API keys, or personally identifiable information stored in related collections. The extraction of password-reset tokens is particularly dangerous as it enables account takeover attacks without requiring brute force techniques or phishing. By observing the presence or absence of specific data patterns in join results, an attacker can also perform inference attacks to deduce the existence and content of restricted records, thereby gaining a comprehensive map of the system's sensitive data structure even if direct access is partially blocked.
This vulnerability aligns with CWE-209, which describes the generation of error messages containing overly detailed information that could be exploited by attackers, although in this specific case it manifests more accurately as CWE-613, Insufficient Session Expiration, or more broadly under CWE-862, Missing Authorization. From a tactical perspective within the MITRE ATT&CK framework, this behavior corresponds to Tactic TA0007 Discovery and Technique T1005 Data from Local System Retrieval, as well as potentially T1539 Steal Web Session Cookie if session tokens are exposed through similar join mechanisms. The attack vector is classified as Network-based with low complexity, requiring only authenticated access to the CMS interface or API, making it a significant risk for any deployment where multiple user roles interact with shared content collections.
To mitigate this vulnerability, organizations must immediately upgrade Payload CMS to version 3.90.0 or later, which includes patches that enforce strict field-level permission checks during polymorphic join operations. For environments unable to patch immediately due to dependency constraints, administrators should implement a reverse proxy rule set that restricts access to API endpoints handling complex queries until the update is applied. Additionally, reviewing and tightening role-based permissions by removing unnecessary read privileges on sensitive collections can reduce the blast radius of this flaw. It is also recommended to audit existing polymorphic relationships in custom schemas to ensure they do not inadvertently expose cross-collection data through indirect means such as counting operations or existence checks that might bypass standard field restrictions. Regular security audits and penetration testing focusing on access control logic are essential to identify similar implementation gaps before exploitation occurs.