p PatchFirst

CVE-2026-105849

CVE-2026-105849 · Payload: API key disclosure through ordinary document reads

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 7.7 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • payload

    Versions
    • >= 3.0.0, < 3.90.0: Affected
    • >= 4.0.0-canary.0, < 4.0.0-canary.34: Affected

    No fix published

  • payload npm

    Affected ranges
    • SEMVER: ≥ 3.0.0, < 3.90.0

    Update to 3.90.0

  • payload npm

    Affected ranges
    • SEMVER: ≥ 4.0.0-canary.0, < 4.0.0-canary.34

    Update to 4.0.0-canary.34

Original sources

Check your server →