CVE-2026-105852: Payload relationship-query authorization bypass
Impact
A readable collection could expose information about protected documents in a related collection.
You are affected if:
- You expose a readable collection with a relationship to a collection protected by access.read where constraints.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
There is no complete workaround. Upgrade Payload packages >= 3.90.0 or >= 4.0.0-canary.34.
Other sources
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments are affected when they expose a readable collection that has a relationship to another collection whose access.read policy uses where constraints. Versions before 3.90.0 and canary versions before 4.0.0-canary.34 are affected.
What access does an attacker need?
The issue can be triggered by querying the readable collection. The supplied CVSS vector indicates network exploitation with low complexity, no privileges, and no user interaction.
What information could be exposed?
Information about documents in the related protected collection may be exposed despite its access.read where constraints. The described impact is confidentiality exposure; no integrity or availability impact is indicated.
What can be done if an immediate upgrade is not possible?
No complete workaround is available. Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later for the canary release line.