CVE-2026-63316: SQL Injection in Payload CMS

Q: Which deployments are exposed to this issue?

Payload CMS deployments using versions earlier than 3.90.0, or canary builds earlier than 4.0.0-canary.34, are affected.

Q: What access does an attacker need?

An attacker must be authenticated. Exploitation occurs through user-controlled input supplied to the "in" and "not_in" query parameters.

Q: Is user interaction required for exploitation?

No. The CVSS vector indicates that no user interaction is required and that the attack can be performed over the network.

Q: What is the remediation?

Upgrade Payload CMS to version 3.90.0 or later, or to 4.0.0-canary.34 or later for the canary release line.

Published Oct 13, 2026

Updated

A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "notin" query paramethers allows an authenticated attacker to perform SQL Injection attacks.

This issue was fixed in version 3.90.0 and 4.0.0-canary.34.

Affected Software

1 affected component

npm/payload<3.90.0, <4.0.0-canary.34

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Payload CMS to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload CMS to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34

Event History

Oct 13, 2026

CVE Published

via MITRE·11:05 AM

Data Sourced

via MITRE·11:05 AM

DescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Payload CMS deployments using versions earlier than 3.90.0, or canary builds earlier than 4.0.0-canary.34, are affected.

What access does an attacker need?

An attacker must be authenticated. Exploitation occurs through user-controlled input supplied to the "in" and "not_in" query parameters.

Is user interaction required for exploitation?

No. The CVSS vector indicates that no user interaction is required and that the attack can be performed over the network.

What is the remediation?

Upgrade Payload CMS to version 3.90.0 or later, or to 4.0.0-canary.34 or later for the canary release line.

CVE-2026-63316: SQL Injection in Payload CMS

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

Is user interaction required for exploitation?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

Is user interaction required for exploitation?

What is the remediation?