CVE-2026-105847: Payload CMS Information Disclosure Vulnerability

CVE-2026-105847 Overview

CVE-2026-105847 is an information disclosure vulnerability in Payload, an open source headless content management system. The flaw affects versions 3.0.0 through 3.89.x and canary versions before 4.0.0-canary.34. An authenticated user who can query a collection containing a polymorphic join can infer hidden or read-restricted field values, including password-reset tokens, by abusing polymorphic join filters. The issue is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor] and is fixed in versions 3.90.0 and 4.0.0-canary.34.

Critical Impact
Low-privileged authenticated users can extract password-reset tokens and other read-restricted fields, enabling potential account takeover of higher-privileged accounts.

Affected Products

Payload CMS versions 3.0.0 through 3.89.x
Payload CMS canary versions prior to 4.0.0-canary.34
Applications using collections with polymorphic join relationships to sensitive fields

Discovery Timeline

2026-10-06 - CVE-2026-105847 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105847

Vulnerability Analysis

Payload CMS supports polymorphic join fields, which allow a single relationship to reference multiple collection types. Query validation for standard field paths correctly rejects paths referencing hidden or access-restricted fields. However, the validator applied a bypass branch for polymorphic join queries that matched a broad path regex, permitting field paths that should have been rejected.

An attacker with query access to an affected collection can craft filter conditions that reference restricted fields on the joined-to collection, including password, hash, salt, and password-reset token fields. By submitting boolean filter predicates and observing which records are returned, the attacker can infer the restricted value character by character. This oracle style disclosure is sufficient to recover active password-reset tokens, which can then be redeemed to take over the targeted account.

Root Cause

The root cause is overly permissive handling of invalid field paths inside polymorphic join query validation in packages/payload/src/database/queryValidation/validateSearchParams.ts. When a path was flagged invalid, the validator skipped error reporting whenever the query was a polymorphic join and the path matched SAFE_FIELD_PATH_REGEX. This logic suppressed validation for known-but-restricted fields rather than only for genuinely unknown polymorphic subpaths.

Attack Vector

Exploitation requires network access to the Payload API and valid credentials for a role that can run find queries against a collection containing a polymorphic join. No user interaction is required on the victim's side. The attacker iteratively submits filter queries containing comparison operators against sensitive target fields and infers values from the response set.

typescript

// Patch from packages/payload/src/database/queryValidation/validateSearchParams.ts
// Rejects hidden fields in polymorphic join queries
   promises.push(
     ...paths.map(async ({ collectionSlug, field, invalid, path }, i) => {
       if (invalid) {
-        if (!polymorphicJoin || !SAFE_FIELD_PATH_REGEX.test(incomingPath)) {
+        const isUnknownPolymorphicJoinField =
+          polymorphicJoin && !field && SAFE_FIELD_PATH_REGEX.test(incomingPath)
+
+        if (!isUnknownPolymorphicJoinField) {
           errors.push({ path })
         }

Source: GitHub commit caa3f69. The fix narrows the bypass to the specific case where the field is genuinely unknown on the polymorphic target, so paths that resolve to restricted fields are now rejected.

Detection Methods for CVE-2026-105847

Indicators of Compromise

API query logs containing where clauses that reference resetPasswordToken, hash, salt, or other restricted fields on polymorphic join relationships.
Repeated find requests from a single authenticated session with incrementally changing filter predicates against the same collection.
Unexpected successful password resets following bursts of query activity from a low-privileged account.

Detection Strategies

Enable verbose request logging on the Payload API and alert on query filters referencing fields that should never appear in client-supplied where clauses.
Baseline normal query volume per authenticated user and flag sustained high-rate querying of collections that contain polymorphic joins.
Correlate authentication events, specifically password-reset completions, with preceding query patterns from the same source IP or user.

Monitoring Recommendations

Forward Payload application logs and reverse-proxy access logs to a centralized analytics platform for retention and query.
Monitor for anomalous use of like, contains, greater_than, and less_than operators against collections exposing polymorphic joins.
Track administrative account logins immediately after password-reset flows to identify potential takeover.

How to Mitigate CVE-2026-105847

Immediate Actions Required

Upgrade Payload to version 3.90.0 or 4.0.0-canary.34 or later as soon as possible.
Invalidate any outstanding password-reset tokens if exploitation is suspected and force password resets for privileged accounts.
Review access control configuration on collections that contain polymorphic join fields and restrict read access where feasible.

Patch Information

The fix is published in Payload v3.90.0 and canary 4.0.0-canary.34. Technical details are documented in GHSA-fpww-c55p-cjv6 and the corresponding upstream commit.

Workarounds

Temporarily remove or restrict polymorphic join fields on collections that reference auth-enabled collections containing password or reset-token fields.
Tighten access.read functions on affected collections to deny queries from non-administrative roles until the patch is applied.
Place the Payload API behind an authenticated reverse proxy that rejects where clauses targeting known sensitive field names.

bash

# Upgrade Payload CMS to a patched release
npm install payload@^3.90.0
# or for the v4 canary track
npm install payload@4.0.0-canary.34