CVE-2026-105861
Received Received - Intake

Authenticated External URL Upload in Payload CMS Session Exposure

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-105861
EUVD
EUVD-2026-93507

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
payloadcms payload > 3.0.0, < 3.90.0
payloadcms payload > 4.0.0-canary.0, < 4.0.0-canary-34

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Payload CMS versions after 3.0.0 and before 3.90.0 have an issue where authenticated external URL-based upload retrieval can forward authentication data to a redirected destination without verifying its trustworthiness. This could expose a valid session to an unintended recipient.

Impact Analysis

An attacker could exploit this to gain access to your authenticated session, potentially allowing them to perform actions on your behalf or access sensitive data within the CMS.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, potentially violating GDPR or HIPAA compliance requirements related to data protection and access control.

Mitigation Strategies

Immediately upgrade Payload CMS to version 3.90.0 or later to address the vulnerability. Ensure all instances are updated to prevent potential session exposure through untrusted redirects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105861. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart