GHSA-xgv3-crq2-6f69: Infoleak
Impact
Token refresh and password reset responses could return fields that the requesting user did not have access to.
You are affected if:
- An authentication collection contains hidden or read-restricted fields.
Patches
Authentication responses now apply field access and hidden-field filtering before returning user documents. Full user documents remain available server-side for access control.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Custom authentication strategies remain responsible for filtering user documents returned through custom responses.
Workarounds
There is no complete workaround. Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments are affected when an authentication collection contains fields that are hidden or restricted by field-level access controls. Token refresh and password reset responses may expose those fields to the requesting user.
What responses need to be reviewed for exposure?
Review token refresh and password reset responses, particularly where authentication collections include hidden or read-restricted fields. The issue concerns user document fields returned in those responses.
Is there a mitigation if an immediate upgrade is not possible?
No complete workaround is available. Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later.
Do custom authentication strategies receive the fix automatically?
No. Custom authentication strategies remain responsible for filtering user documents that they return through custom responses.