CVE-2026-105849

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105849

EUVD

EUVD-2026-93492

Affected Vendors & Products

Vendor	Product	Version / Range
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	4.0.0
payloadcms	payload	From 3.0.0 (inc) to 3.90.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Payload CMS versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34. Users with read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and use the target accounts' permissions until the keys are rotated or disabled.

Detection Guidance

To detect this vulnerability, check Payload CMS versions between 3.0.0 and 3.90.0 or canary versions before 4.0.0-canary.34. Verify if useAPIKey is enabled in collections with read access. Inspect API key rotation logs for unauthorized access patterns.

Impact Analysis

An attacker with read access could escalate privileges by obtaining active API keys, allowing them to perform actions on behalf of other users. This could lead to unauthorized data access, modification, or deletion within the CMS.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, data breaches, and potential legal penalties.

Mitigation Strategies

Update Payload CMS to version 3.90.0 or later for stable releases, or 4.0.0-canary.34 or later for canary versions. Disable the useAPIKey feature if not required or restrict read access to authentication documents.

Hi! I’m here to help you understand CVE-2026-105849. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70