CVE-2026-105856

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in.

In Payload versions before 3.90.0 and canary before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions before 3.90.0 and canary before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. Fixed in versions 3.90.0 and 4.0.0-canary.34.

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. Fixed in versions 3.90.0 and 4.0.0-canary.34.

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes.

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read.