Payload CMS up to 3.87.x/4.0.0-canary.26 Sorting sort information disclosure

Summaryinfo

A vulnerability was found in Payload CMS Payload up to 3.87.x/4.0.0-canary.26. It has been classified as problematic. The affected element is an unknown function of the component Sorting. Performing a manipulation of the argument sort results in information disclosure. This vulnerability is identified as CVE-2026-105805. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Payload CMS Payload up to 3.87.x/4.0.0-canary.26. It has been classified as problematic. This affects an unknown code block of the component Sorting. The manipulation of the argument sort with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-105805 since 10/05/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 3.88.0 or 4.0.0-canary.27 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-93464). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Payload CMS

Name

• Payload

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.37
• 3.38
• 3.39
• 3.40
• 3.41
• 3.42
• 3.43
• 3.44
• 3.45
• 3.46
• 3.47
• 3.48
• 3.49
• 3.50
• 3.51
• 3.52
• 3.53
• 3.54
• 3.55
• 3.56
• 3.57
• 3.58
• 3.59
• 3.60
• 3.61
• 3.62
• 3.63
• 3.64
• 3.65
• 3.66
• 3.67
• 3.68
• 3.69
• 3.70
• 3.71
• 3.72
• 3.73
• 3.74
• 3.75
• 3.76
• 3.77
• 3.78
• 3.79
• 3.80
• 3.81
• 3.82
• 3.83
• 3.84
• 3.85
• 3.86
• 3.87
• 4.0.0-canary.0
• 4.0.0-canary.1
• 4.0.0-canary.2
• 4.0.0-canary.3
• 4.0.0-canary.4
• 4.0.0-canary.5
• 4.0.0-canary.6
• 4.0.0-canary.7
• 4.0.0-canary.8
• 4.0.0-canary.9
• 4.0.0-canary.10
• 4.0.0-canary.11
• 4.0.0-canary.12
• 4.0.0-canary.13
• 4.0.0-canary.14
• 4.0.0-canary.15
• 4.0.0-canary.16
• 4.0.0-canary.17
• 4.0.0-canary.18
• 4.0.0-canary.19
• 4.0.0-canary.20
• 4.0.0-canary.21
• 4.0.0-canary.22
• 4.0.0-canary.23
• 4.0.0-canary.24
• 4.0.0-canary.25
• 4.0.0-canary.26

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion