CVE-2026-105805: Payload CMS Information Disclosure Flaw

CVE-2026-105805 Overview

CVE-2026-105805 affects Payload, a free and open source headless content management system. The vulnerability allows an untrusted user who can query a readable collection to infer limited information about field values they are not authorized to read. The attacker achieves this by controlling the sort order and selecting a protected field as the sort parameter. The flaw exists in Payload versions before 3.88.0 and canary versions before 4.0.0-canary.27. The issue is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Attackers with query access to a collection can infer values of protected fields through sort-based side-channel leakage, enabling partial disclosure of data they lack read permissions for.

Affected Products

Payload CMS versions prior to 3.88.0
Payload CMS canary versions prior to 4.0.0-canary.27
Deployments exposing readable collections with field-level access control to untrusted users

Discovery Timeline

2026-10-06 - CVE-2026-105805 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105805

Vulnerability Analysis

Payload CMS enforces field-level access control to restrict which fields a user can read in a given collection. The vulnerability bypasses this control at the query sort layer. When a user issues a query that includes a sort parameter referencing a protected field, Payload applies the ordering server-side before stripping fields the user cannot read. The resulting order of returned documents reflects the protected field's values, giving the client an observable side channel.

An authenticated or anonymous attacker with query rights can enumerate ordering across multiple requests, comparing permutations to deduce relative or exact values of protected fields. This constitutes a classic information disclosure weakness tracked as [CWE-200].

Root Cause

The root cause is incomplete enforcement of field-level access control at the query planning stage. Sort parameters are validated against the collection schema but not against the requesting user's field read permissions. The database applies the sort using the real field values, and the server returns documents in that order even after redacting fields the user cannot see.

Attack Vector

Exploitation requires network access to the Payload API and the ability to query a readable collection. The attacker crafts list queries that set the sort parameter to a protected field name. By combining ascending and descending orders, pagination, and filter predicates, the attacker narrows ranges and infers values without ever reading the field directly. No authentication is required when the collection is publicly readable.

The advisory references the fix commit and release notes. See the GitHub Security Advisory GHSA-9g87-32v6-3c2r for upstream details.

text

// Patch excerpt from the fix commit
 import Link from 'next/link'
 import { useRouter, useSearchParams } from 'next/navigation'
+import { getSafeRedirect } from 'payload/shared'
 import React, { useCallback, useRef, useState } from 'react'
 import { useForm } from 'react-hook-form'

Source: GitHub Commit a742140

Detection Methods for CVE-2026-105805

Indicators of Compromise

Repeated API list requests to the same collection that vary only the sort parameter across protected field names.
Query patterns that combine ascending and descending sorts on identical filters, consistent with inference enumeration.
Elevated query volume from a single client against collections with field-level access control enabled.

Detection Strategies

Instrument the Payload API to log the sort field used in every query and correlate it against the requesting user's field read permissions.
Alert when a client requests sorting on a field that the user is denied from reading in the response.
Baseline normal sort usage per collection and flag statistical anomalies in sort-field distribution.

Monitoring Recommendations

Forward Payload API access logs to a central analytics platform for query pattern analysis.
Track per-user query rates and sort parameter diversity to surface enumeration behavior.
Review audit trails for anonymous or low-privilege sessions issuing high volumes of sorted queries.

How to Mitigate CVE-2026-105805

Immediate Actions Required

Upgrade Payload CMS to version 3.88.0 or later, or to canary version 4.0.0-canary.27 or later.
Audit all collections that expose field-level access control and confirm no untrusted principal retains query rights without the patch applied.
Rotate or re-evaluate sensitivity classifications for any field whose values may have been inferred during the exposure window.

Patch Information

The vendor fix is included in Payload 3.88.0 and canary 4.0.0-canary.27. Release details are available in the GitHub Release v3.88.0 notes, and the underlying change is tracked in GitHub Commit a742140.

Workarounds

Restrict access control on vulnerable collections so that untrusted users cannot issue arbitrary list queries.
Validate incoming sort parameters at an API gateway or middleware layer and reject any sort key the caller cannot read.
Disable sorting entirely on collections containing protected fields until the upgrade is applied.

bash

# Upgrade Payload to the patched release
npm install payload@3.88.0
# or for canary users
npm install payload@4.0.0-canary.27