CVE-2026-105853
Received Received - Intake

Token Refresh and Password Reset Information Disclosure in Payload CMS

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-105853
EUVD
EUVD-2026-93497

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
payloadcms payload >= 3.0.0, < 3.90.0
payloadcms payload >= 4.0.0-canary.0, < 4.0.0-canary.34

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34 have an issue where token refresh and password reset responses may expose hidden or read-restricted fields to unauthorized users. This occurs due to improper handling of sensitive data in responses.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. I don't know

Impact Analysis

An attacker could gain access to sensitive information they are not authorized to view by exploiting this flaw during token refresh or password reset processes. This may lead to data breaches or unauthorized modifications if combined with other vulnerabilities.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by exposing unauthorized users to restricted data. Organizations using affected versions may face compliance violations, fines, or legal consequences due to unauthorized data exposure.

Mitigation Strategies

Update Payload CMS to version 3.90.0 or later for the stable release, or to version 4.0.0-canary.34 or later for the canary release. This addresses the issue where token refresh and password reset responses expose hidden or restricted fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105853. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart