CVE-2026-105849: Payload: API key disclosure through ordinary document reads
Impact
Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled.
You are affected if:
- An authentication collection enables useAPIKey. - Users have read access to other user documents containing active API keys.
Patches
Users should upgrade payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Disable useAPIKey or restrict users to reading only their own authentication document. Rotate any API key that may have been exposed.
Other sources
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Configuration
Disable useAPIKey, or restrict users to reading only their own authentication document.
Payload authentication collection useAPIKey = disabled - Operational
Rotate any API key that may have been exposed.
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use an authentication collection with useAPIKey enabled and allow users to read authentication documents belonging to other users. Versions from 3.0.0 before 3.90.0, and canary versions before 4.0.0-canary.34, are affected under those conditions.
What access does an attacker need to exploit this issue?
An attacker needs ordinary read access to other users' authentication documents in a collection where useAPIKey is enabled. No additional interaction is required once that access is available.
What can an exposed API key allow?
An exposed active API key can be used with the permissions of the account to which it belongs. That access remains available until the key is rotated or disabled.
What should be done if upgrading cannot happen immediately?
Disable useAPIKey or restrict users so they can read only their own authentication document. Rotate any API keys that may have been exposed.
Which versions contain the fix?
Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later for the canary release line.