CVE-2026-105853: Payload CMS Information Disclosure Flaw

CVE-2026-105853 Overview

Payload is a free and open source headless content management system (CMS) built on Node.js and TypeScript. CVE-2026-105853 is an information disclosure vulnerability affecting Payload versions from 3.0.0 before 3.90.0, and canary versions before 4.0.0-canary.34. Token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user is not authorized to access. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Maintainers released fixes in versions 3.90.0 and 4.0.0-canary.34.

Critical Impact
Authenticated users can retrieve read-restricted and hidden fields from auth collection documents through routine token refresh and password reset flows, exposing sensitive user data.

Affected Products

Payload CMS versions 3.0.0 through 3.89.x
Payload CMS canary versions prior to 4.0.0-canary.34
Applications using Payload auth collections with hidden or access-restricted fields

Discovery Timeline

2026-10-06 - CVE-2026-105853 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105853

Vulnerability Analysis

Payload CMS exposes authentication endpoints that return user documents after successful operations. In vulnerable versions, the token refresh endpoint and the password reset endpoint construct response payloads from the raw auth collection document without applying the field-level access control and hidden field filtering normally enforced by Payload's find and findByID operations.

As a result, a caller holding a valid refresh token or completing a password reset receives fields that would be stripped from a normal read request. This includes fields explicitly marked hidden: true and fields whose access.read function denies the requesting user. The impact is bounded to confidentiality of auth collection data, but that data commonly includes custom fields such as internal roles, API keys, billing identifiers, or integration secrets.

Root Cause

The refresh and reset operations in packages/payload/src/auth/operations/refresh.ts and the corresponding password reset handler returned the user document without re-running the collection's read access control pipeline. The patch adds validation of the auth collection during token refresh and imports the APIError type alongside Forbidden, enforcing that responses respect the same field-level restrictions applied to standard reads.

Attack Vector

Exploitation requires low-privilege authentication, meaning any legitimate user of the Payload application. The attacker calls the standard /api/{collection}/refresh-token or password reset endpoint and parses the JSON response for fields that should have been hidden. No special tooling, elevated privileges, or user interaction is required beyond holding a valid session.

typescript

+import { status as httpStatus } from 'http-status'
+
 import type { Collection } from '../../collections/config/types.js'
 import type { Document, PayloadRequest } from '../../types/index.js'
 
 import { buildAfterOperation } from '../../collections/operations/utilities/buildAfterOperation.js'
 import { buildBeforeOperation } from '../../collections/operations/utilities/buildBeforeOperation.js'
-import { Forbidden } from '../../errors/index.js'
+import { APIError, Forbidden } from '../../errors/index.js'
 import { commitTransaction } from '../../utilities/commitTransaction.js'
 import { initTransaction } from '../../utilities/initTransaction.js'
 import { killTransaction } from '../../utilities/killTransaction.js'

Source: Payload security patch commit f5f1283. The patch introduces auth collection validation and strengthens error handling in the refresh operation path.

Detection Methods for CVE-2026-105853

Indicators of Compromise

Unusual volumes of requests to /api/{collection}/refresh-token from a single authenticated session.
Password reset completions followed by immediate data extraction patterns in application logs.
Response payloads from auth endpoints containing field names that are declared hidden: true in the collection schema.

Detection Strategies

Review web server and reverse proxy logs for repeated calls to Payload refresh and password reset routes outside normal login flows.
Compare JSON response bodies from auth endpoints against the collection configuration to flag any field that should be access-restricted.
Audit the installed Payload version with npm list payload and flag any instance in the vulnerable range >=3.0.0 <3.90.0.

Monitoring Recommendations

Enable application-level logging of auth operation responses in staging to confirm field filtering after patching.
Alert on authenticated API calls that return response bodies significantly larger than the baseline for the same user role.
Track dependency drift in CI by failing builds that resolve Payload to versions below 3.90.0.

How to Mitigate CVE-2026-105853

Immediate Actions Required

Upgrade Payload to version 3.90.0 or later for the 3.x branch, or 4.0.0-canary.34 or later for canary deployments.
Rotate any credentials, API keys, or secrets that may have been stored in hidden fields of auth collections and could have been exposed.
Review the GitHub Security Advisory GHSA-xgv3-crq2-6f69 for maintainer guidance.

Patch Information

The fix is included in Payload v3.90.0 and 4.0.0-canary.34. The underlying code change in commit f5f1283 adds auth collection validation during token refresh so that responses honor existing read access rules and hidden field declarations.

Workarounds

If immediate upgrade is not possible, remove or relocate sensitive fields from auth collections into separate collections not returned by auth operations.
Temporarily set stricter access.read logic on auth collection fields and audit any custom endpoints that return user documents.
Place a reverse proxy filter in front of /api/*/refresh-token and password reset routes to strip disallowed fields from responses until the upgrade is applied.

bash

# Upgrade Payload to the patched release
npm install payload@^3.90.0

# Verify the installed version is no longer vulnerable
npm list payload