CVE-2026-105852 in Payload
Summary
by MITRE • 10/06/2026
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
Payload CMS contains an authorization bypass vulnerability affecting versions prior to 3.90.0 and canary releases before 4.0.0-canary.34, which allows attackers to access sensitive data through improper enforcement of access control constraints on related documents. The core technical flaw lies in the query execution logic when retrieving records from a collection that maintains relationships with other collections. Specifically, when an application queries a readable collection and includes fields or references linked to another collection, the system fails to properly validate whether the requesting user has explicit read permissions for those related entities. This oversight results in the exposure of information about documents that are protected by access.read constraints, effectively bypassing the intended security boundaries established by the CMS's role-based access control mechanisms.
The operational impact of this vulnerability is significant as it leads to unauthorized data disclosure and a breach of confidentiality within the content management system. Attackers who possess valid credentials with limited permissions can exploit this flaw to retrieve sensitive information from related collections that they should not be able to view. This could include confidential business records, user personal data, or proprietary content stored in linked tables. The vulnerability undermines the integrity of the application's security model by allowing lateral movement across different data sets without proper authentication checks for each specific resource involved in the relationship query.
This issue aligns with CWE-284 Improper Access Control and CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes, as it involves a failure to restrict access to resources based on user privileges during dynamic object resolution. In terms of the MITRE ATT&CK framework, this vulnerability facilitates unauthorized data exfiltration through API endpoints or direct database queries, corresponding to techniques such as T1005 Data from Local System and potentially T1078 Valid Accounts if exploited by authenticated users with insufficient privilege levels. The flaw highlights a common pitfall in relational data handling where parent-child relationships are not fully secured at every level of the query chain.
To mitigate this vulnerability, organizations must upgrade Payload CMS to version 3.90.0 or later, including canary versions 4.0.0-canary.34 and above, which contain patches for these access control checks. For systems that cannot be immediately updated, administrators should implement strict input validation on all query parameters related to populated fields and ensure that custom middleware enforces read permissions recursively across all referenced collections. Additionally, auditing logs should be monitored for unusual patterns of data retrieval involving linked resources, and developers should review the application's security configuration to ensure that access.read constraints are applied consistently regardless of how queries are structured or which relationships are traversed during data fetching operations.