CVE-2026-105849
HIGHCVSS 8.3Description
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Timeline
Published:October 6th, 2026 5:17 PM
Last modified:October 15th, 2026 12:13 AM
CVSS Scoring
CVSS v3: 8.3 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Affected Software
From NVD CPE configuration data
Vendors
payloadcms
Products
payload
References & Reports
Advisories, patches, and third-party reports
Source: NIST NVD · Data may lag official sources by up to one minute