CVE-2026-105866

In Payload versions before 3.90.0 and canary before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions before 3.90.0 and 4.0.0-canary.34, an attacker with read and create/update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through crafted field paths and operators. Collections without those fields and richText fields are not affected. SQLite packages fixed in 3.90.0 and 4.0.0-canary.34, Postgres fixed in 3.73.0.

In Payload versions before 3.90.0 and canary before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. Fixed in versions 3.90.0 and 4.0.0-canary.34.

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. Fixed in versions 3.90.0 and 4.0.0-canary.34.

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes.

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read.