CVE-2026-105847: Payload Package Vulnerability Exposes Hidden Fields via Polymorphic Join Queries
Summary
CVE-2026-105847: Payload: Polymorphic join queries could disclose hidden fields. Affects payload across 2 version ranges.
>= 3.0.0, < 3.90.0
>= 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Payload is a powerful open-source framework designed for building content management systems and applications with a focus on flexibility and ease of use. It allows developers to create custom data structures and manage content seamlessly. However, a recent vulnerability has been identified that could expose sensitive information through polymorphic join queries, potentially compromising user data.
Vulnerability Detail
The vulnerability arises from the way Payload handles polymorphic join filters, which can be exploited by users with query access. This allows them to infer hidden or read-restricted field values, including sensitive information such as password-reset tokens. The issue is particularly concerning as it could lead to unauthorized access to critical user data, making it a high-severity vulnerability.
How To Fix
Latest published version: 3.92.0 as of 23 Oct 2026
npm install payload@3.92.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.90.03.90.0npm install payload@3.90.0 -
>= 4.0.0-canary.0, < 4.0.0-canary.344.0.0-canary.34npm install payload@4.0.0-canary.34
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
While there is no complete workaround, it is advisable to restrict read access to sensitive collections to reduce exposure. This can be done by adjusting the permissions in your Payload configuration to limit access to sensitive fields.
Conclusion
In summary, CVE-2026-105847 poses a significant risk to users of the Payload package by allowing unauthorized access to sensitive information through polymorphic join queries. It is essential to upgrade to the patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for payload →
FAQ
CVE-2026-105847 is a vulnerability in the Payload package that allows users to infer hidden field values through polymorphic join queries.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can access the Vulert playground at Vulert Scanner without any signup.
The vulnerability could lead to unauthorized access to sensitive information, including password-reset tokens, which could compromise user accounts and data security.
If you cannot upgrade immediately, it is crucial to restrict read access to sensitive collections as a temporary measure to mitigate the risk.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for payload.
