CVE-2026-105805: Payload: Sort queries could expose protected field information
Impact Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read.
You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.
Patches Payload now applies field-level access checks to sort fields before executing queries.
Users should upgrade to >= 3.88.0 or >= 4.0.0-canary.27.
Workarounds Upgrading is recommended. Until then, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.
Other sources
Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Compensating control
Until upgrading, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are affected when untrusted users can query a collection they are allowed to read, control the sort parameter, and specify a field protected by field-level access controls as the sort field.
What could an attacker learn?
An attacker could infer limited information about values in protected fields, despite not having permission to read those fields directly. The issue affects confidentiality; no integrity or availability impact is described.
What versions contain the fix?
Upgrade to Payload 3.88.0 or later, or to 4.0.0-canary.27 or later for the canary release line.
What can be done before upgrading?
Prevent untrusted users from controlling sort parameters, or restrict their access to collections where protected fields could be used for sorting.