Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
References
| Link | Resource |
|---|---|
| https://github.com/payloadcms/payload/commit/f5f1283d275c58b30e2faa6be7cdc4d49451ea91 | Patch |
| https://github.com/payloadcms/payload/releases/tag/v3.90.0 | Patch Release Notes |
| https://github.com/payloadcms/payload/security/advisories/GHSA-xgv3-crq2-6f69 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Oct 2026, 00:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:* |
|
| First Time |
Payloadcms payload
Payloadcms |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://github.com/payloadcms/payload/commit/f5f1283d275c58b30e2faa6be7cdc4d49451ea91 - Patch | |
| References | () https://github.com/payloadcms/payload/releases/tag/v3.90.0 - Patch, Release Notes | |
| References | () https://github.com/payloadcms/payload/security/advisories/GHSA-xgv3-crq2-6f69 - Vendor Advisory |
06 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 17:17
Updated : 2026-10-15 00:12
NVD link : CVE-2026-105853
Mitre link : CVE-2026-105853
CVE.ORG link : CVE-2026-105853
JSON object : View
Products Affected
payloadcms
- payload
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor