CVE-2026-105853: Payload Token Refresh and Password Reset Responses Expose Restricted User Fields
Summary
CVE-2026-105853: Payload: Token refresh and password reset responses may expose restricted user fields. Affects payload across 2 version ranges.
>= 3.0.0, < 3.90.0
>= 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Payload is an open-source content management system (CMS) built for developers. It allows for the creation of custom applications and provides a flexible API for managing content. The system is designed to be extensible and user-friendly, making it a popular choice for developers looking to build applications quickly. However, it has been identified that certain responses during token refresh and password reset processes may inadvertently expose sensitive user information that should remain restricted.
Vulnerability Detail
The vulnerability arises from improper handling of user data in authentication responses. Specifically, when a user requests a token refresh or a password reset, the system may return fields that the user should not have access to, including hidden or read-restricted fields. This can lead to unauthorized access to sensitive information, potentially compromising user privacy and security. The issue is particularly concerning as it affects the integrity of user data management within the application.
How To Fix
Latest published version: 3.92.0 as of 23 Oct 2026
npm install payload@3.92.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.90.03.90.0npm install payload@3.90.0 -
>= 4.0.0-canary.0, < 4.0.0-canary.344.0.0-canary.34npm install payload@4.0.0-canary.34
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no complete workaround for this vulnerability. The recommended action is to upgrade to the patched versions as mentioned above. Custom authentication strategies must also ensure that they filter user documents appropriately in their responses.
Conclusion
In summary, CVE-2026-105853 presents a significant risk to applications using the Payload CMS, as it allows unauthorized access to restricted user fields during token refresh and password reset processes. It is crucial for users to upgrade to the latest patched versions to protect their applications from potential data breaches.
See every vulnerability recorded for payload →
FAQ
CVE-2026-105853 is a vulnerability in the Payload CMS that allows token refresh and password reset responses to expose restricted user fields.
If your application uses Payload and is running an affected version, unauthorized users may gain access to sensitive user information through token refresh or password reset responses.
You should upgrade your Payload package to version '>= 3.90.0' or '>= 4.0.0-canary.34' to mitigate the risk associated with this vulnerability.
There are no complete workarounds. The only effective solution is to upgrade to the patched versions of the Payload package.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can help you identify if your application is affected by vulnerabilities like CVE-2026-105853.
References
Related vulnerabilities
Recent vulnerabilities recorded for payload.
