payloadcms/payload · Security
Payload: Polymorphic join queries could disclose hidden fields
- GHSA ID
- GHSA-fpww-c55p-cjv6
- CVE ID
- CVE-2026-105847
- Severity
- high
- Published
- Updated
- CVSS v4
- 7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Impact
A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens.
You are affected if:
- You use an affected Payload version.
- Users can query a collection with a polymorphic join to sensitive fields.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
There is no complete workaround. Restricting read access to sensitive collections reduces exposure but does not replace upgrading.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CWE-639 · Authorization Bypass Through User-Controlled Key