CVE-2026-105852: Payload CMS Information Disclosure Flaw

CVE-2026-105852 Overview

CVE-2026-105852 is an authorization vulnerability in Payload CMS, a free and open source headless content management system. The flaw affects versions before 3.90.0 and canary versions before 4.0.0-canary.34. When a client queries a readable collection with a relationship to another collection, Payload fails to apply the access.read where constraints to the related documents. This allows unauthenticated or low-privilege requesters to infer the existence and properties of protected related documents through relationship queries. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact

Attackers can enumerate and extract information about related documents that should be hidden by collection-level access.read where constraints, breaking tenant isolation and document-level access controls.

Affected Products

• Payload CMS versions prior to 3.90.0
• Payload CMS canary versions prior to 4.0.0-canary.34
• Applications using the MongoDB adapter (@payloadcms/db-mongodb) or Drizzle adapter (@payloadcms/drizzle) with cross-collection relationships

Discovery Timeline

• 2026-10-06 - CVE CVE-2026-105852 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105852

Vulnerability Analysis

Payload CMS enforces field- and document-level authorization through access.read functions that return a where constraint applied to database queries. The vulnerability stems from the query builders in the MongoDB and Drizzle database adapters not scoping these access filters to the related document when traversing a relationship field.

When a user queries collection A with a filter that traverses a relationship into collection B, the server joins or looks up documents in B without re-applying B's own access.read where constraints against the same document being joined. As a result, a client can craft queries whose matching behavior leaks whether specific documents exist in the related collection or whether specific field values are present, even when the user has no direct read access to those records. This is a classic missing authorization pattern aligned with [CWE-862].

The impact is bounded to confidentiality — no integrity or availability loss is involved — but it undermines the primary access control contract that Payload applications rely on for multi-tenant and permissioned data.

Root Cause

The root cause is in the relationship query construction logic. In the MongoDB adapter (packages/db-mongodb/src/queries/buildSearchParams.ts) and the Drizzle adapter (packages/drizzle/src/queries/getTableColumnFromPath.ts), relationship traversals built the join or subquery without applying the related collection's access-control where scoped to the correlated document. Polymorphic on relationships compounded the problem, because they are stored in a _rels table with no direct correlation column, which the patched code now explicitly rejects.

Attack Vector

Exploitation requires only network access to a Payload CMS HTTP API that exposes any readable collection with a relationship to a protected collection. No authentication, user interaction, or elevated privileges are required when the parent collection is publicly readable. An attacker iteratively issues where queries over the relationship field — using operators such as equals, in, or like — and observes which parent documents match. The match pattern reveals field values of related documents that the attacker cannot read directly.

// Security patch excerpt — MongoDB adapter
// packages/db-mongodb/src/queries/buildSearchParams.ts
import { Types } from 'mongoose'
import { APIError, escapeRegExp, getFieldByPath, getLocalizedPaths } from 'payload'
-import { validOperatorSet } from 'payload/shared'
+import { isNestedRelationshipQuery, validOperatorSet } from 'payload/shared'

import type { MongooseAdapter } from '../index.js'
import type { OperatorMapKey } from './operatorMap.js'

// Security patch excerpt — Drizzle adapter
// packages/drizzle/src/queries/getTableColumnFromPath.ts
const newCollectionPath = pathSegments.slice(1).join('.')

// Filtering through a polymorphic `on` relationship is not supported: it is stored in the
// `_rels` table with no direct column to correlate on, which would otherwise build invalid SQL.
const onRelationshipField = getFieldByPath({
  fields: adapter.payload.collections[field.collection].config.flattenedFields,
  path: field.on,
})?.field

if (
  onRelationshipField &&
  (onRelationshipField.type === 'relationship' || onRelationshipField.type === 'upload') &&
  Array.isArray(onRelationshipField.relationTo)
) {
  throw new APIError('Not supported')
}

Source: GitHub Commit 94059cf

Detection Methods for CVE-2026-105852

Indicators of Compromise

• Repeated API queries against readable Payload collections that filter on nested relationship paths using operators such as equals, in, like, or contains.
• High volumes of REST or GraphQL requests with incrementally varying where[relationshipField.someField] parameters consistent with enumeration.
• APIError: Not supported responses after upgrade, indicating prior client code was relying on polymorphic on relationship filtering.

Detection Strategies

• Review Payload server access logs for GET and POST requests to collection endpoints containing nested where clauses that reference fields in protected related collections.
• Correlate query bursts from a single IP or API token against relationship paths to identify enumeration patterns.
• Audit application-level access logs produced by Payload hooks for queries returning results that would not match the caller's direct access.read on the related collection.

Monitoring Recommendations

• Instrument the Payload HTTP layer to record the authenticated user, collection, and where payload for every list query, then alert on anomalous relationship-path usage.
• Track installed Payload versions across environments and alert when any instance runs a version earlier than 3.90.0 or a canary earlier than 4.0.0-canary.34.
• Forward Payload application logs into a centralized analytics tier so query enumeration patterns can be identified across the fleet.

How to Mitigate CVE-2026-105852

Immediate Actions Required

• Upgrade all Payload CMS deployments to version 3.90.0 or later, or to canary 4.0.0-canary.34 or later.
• Rotate API keys and session secrets if logs indicate relationship-based enumeration against sensitive collections prior to patching.
• Review access.read definitions on every collection reachable through a relationship from a publicly readable collection and confirm expected scoping after upgrade.

Patch Information

The fix is delivered in Payload 3.90.0 and canary 4.0.0-canary.34. The patch scopes related-collection access filters to the same document in both the MongoDB and Drizzle adapters, and explicitly rejects filtering through polymorphic on relationships that cannot be safely correlated. See the GitHub Security Advisory GHSA-7c34-32v3-j575 and the GitHub Release v3.90.0 for release notes.

Workarounds

• Restrict public read access on collections that contain relationship fields pointing to sensitive collections until the patch is applied.
• Remove or disable REST and GraphQL query operators on relationship fields at the reverse-proxy layer for untrusted clients.
• Place sensitive collections behind an authenticated API gateway and reject requests whose where payloads reference restricted relationship paths.

# Upgrade Payload CMS to the patched release
npm install payload@^3.90.0 \
  @payloadcms/db-mongodb@^3.90.0 \
  @payloadcms/drizzle@^3.90.0

# Verify installed version
npm ls payload