CVE-2023-30843: Payload's hidden fields can be leaked on readable collections
Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a beforeOperation hook to remove where queries that attempt to access hidden field data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-30843?
CVE-2023-30843 is classified as a medium severity vulnerability.
How do I fix CVE-2023-30843?
To fix CVE-2023-30843, upgrade PayloadCMS to version 1.7.0 or later.
What types of access does CVE-2023-30843 exploit?
CVE-2023-30843 exploits access to documents with hidden fields or fields the user does not have permission to view.
What versions of PayloadCMS are affected by CVE-2023-30843?
PayloadCMS versions prior to 1.7.0 are affected by CVE-2023-30843.
Is CVE-2023-30843 a local or remote vulnerability?
CVE-2023-30843 is a local vulnerability that can be exploited by authenticated users with specific document access.