CVE-2026-105849: Payload CMS API Key Disclosure Vulnerability

CVE-2026-105849 Overview

CVE-2026-105849 is an information exposure vulnerability [CWE-201] in Payload, an open source headless content management system. The flaw affects versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34. Users with ordinary read access to authentication documents in a collection with useAPIKey enabled can retrieve active API keys belonging to other accounts. An attacker holding these keys can then exercise the target account's permissions until the keys are rotated or disabled.

Critical Impact

Low-privileged authenticated users can read API keys for higher-privileged accounts, enabling account takeover and horizontal or vertical privilege escalation across the Payload CMS instance.

Affected Products

• Payload CMS versions 3.0.0 through 3.89.x
• Payload CMS canary versions prior to 4.0.0-canary.34
• Any Payload collection configured with useAPIKey: true

Discovery Timeline

• 2026-10-06 - CVE CVE-2026-105849 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105849

Vulnerability Analysis

Payload supports API key authentication on any auth-enabled collection when useAPIKey is set to true. Each user document in such a collection stores an encrypted apiKey field that authenticates subsequent requests as that user. The vulnerability stems from the apiKey field being returned on standard document read operations without a dedicated field-level access control. Any user who can read other authentication documents therefore receives decrypted API key material. The attacker reuses the key against the Payload REST or GraphQL API and inherits the victim's role, permissions, and collection access.

Root Cause

The field definition in packages/payload/src/auth/baseFields/apiKey.ts registered an afterRead hook that decrypted the stored key for any caller permitted to read the document. No access.read guard restricted the field to the owning user or administrators. The classification matches CWE-201: Insertion of Sensitive Information Into Sent Data.

Attack Vector

Exploitation requires low-privileged authenticated access to a collection that enables useAPIKey. The attacker issues a normal read request, for example GET /api/users/:id or a list query, and parses the apiKey field from the response. The retrieved key is then presented in the Authorization: users API-Key <key> header to perform actions as the victim account.

// Patched field definition — API key field is now restricted
// Source: https://github.com/payloadcms/payload/commit/880d2e900be22cd66a9e939f2b3e702fa413180f
import type { FieldAccess } from '../../../fields/config/types.js'

import { UnauthorizedError } from '../../../errors/UnauthorizedError.js'
import { canAccessAdmin } from '../../../utilities/canAccessAdmin.js'

/** Allows API key creation and updates only for users with admin access. */
export const canCreateOrUpdateAPIKey: FieldAccess = async ({ req }) => {
  if (!req.user) {
    return false
  }

  try {
    await canAccessAdmin({ req })
  } catch (error) {
    if (error instanceof UnauthorizedError) {
      return false
    }

    throw error
  }

  return true
}

Source: GitHub Commit 880d2e9. The patch removes the decrypting afterRead hook and gates key creation and updates behind admin access, so the key value is no longer returned on standard document reads.

Detection Methods for CVE-2026-105849

Indicators of Compromise

• API requests that enumerate authentication collections (for example repeated GET /api/users or GraphQL queries selecting the apiKey field) issued by non-admin principals.
• Authentication events using the users API-Key scheme originating from IP addresses or user agents that do not match the key owner's historical pattern.
• Administrative or write actions performed by an account shortly after that account's record was read by a different session.

Detection Strategies

• Inspect application and reverse-proxy logs for responses from auth-enabled collection endpoints whose payload size suggests the apiKey field is being returned.
• Audit Payload access control configuration to identify collections where useAPIKey is enabled and field-level read access on apiKey is not explicitly restricted.
• Correlate API key usage with the key owner's interactive session activity to flag concurrent or geographically inconsistent use.

Monitoring Recommendations

• Enable verbose authentication logging in Payload and forward logs to a centralized analytics platform for query and alerting.
• Alert on any read of authentication collection documents performed by non-admin users above a defined baseline.
• Track the rate of failed and successful API-Key authentications per key to detect brute force or reuse from new sources.

How to Mitigate CVE-2026-105849

Immediate Actions Required

• Upgrade Payload to version 3.90.0 or 4.0.0-canary.34 or later without delay.
• Rotate every API key issued on collections with useAPIKey enabled, treating all pre-patch keys as compromised.
• Review audit logs for suspicious reads of authentication collections and for API key usage inconsistent with the owning user's activity.
• Reduce the blast radius by auditing which roles currently hold read access to authentication collections.

Patch Information

The fix is included in Payload 3.90.0 and 4.0.0-canary.34. See the GitHub Security Advisory GHSA-238x-w2j9-gwwr and the v3.90.0 release notes. The code change is tracked in commit 880d2e9.

Workarounds

• If immediate upgrade is not possible, disable useAPIKey on affected collections and migrate consumers to session-based authentication.
• Add explicit field-level access.read controls on the apiKey field restricting reads to the document owner and administrators.
• Restrict read access on authentication collections so that non-admin users cannot query other users' documents.

# Upgrade Payload to a patched release
npm install payload@^3.90.0
# or, for the canary track
npm install payload@4.0.0-canary.34

# Verify installed version
npm ls payload