CVE-2026-63316: Payload CMS SQL Injection Vulnerability

CVE-2026-63316 Overview

CVE-2026-63316 is a SQL injection vulnerability [CWE-89] in Payload CMS. The flaw stems from improper neutralization of user input passed to the in and not_in query parameters. An authenticated attacker can inject arbitrary SQL statements through these parameters and compromise the backing database.

Payload CMS maintainers fixed the issue in versions 3.90.0 and 4.0.0-canary.34. The vulnerability is exploitable over the network with low attack complexity and requires only low-privileged authentication.

Critical Impact
Authenticated attackers can read, modify, or exfiltrate database contents by injecting SQL through the in and not_in query parameters.

Affected Products

Payload CMS versions prior to 3.90.0
Payload CMS 4.x versions prior to 4.0.0-canary.34
Deployments exposing the Payload CMS REST or GraphQL query API to authenticated users

Discovery Timeline

2026-10-13 - CVE CVE-2026-63316 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-63316

Vulnerability Analysis

Payload CMS exposes query parameters that let API consumers filter collection results. The in and not_in operators accept a list of values used to match records against a given field. The CMS fails to properly sanitize or parameterize these values before incorporating them into the generated SQL statement.

An authenticated attacker can supply crafted input that terminates the intended SQL expression and appends attacker-controlled clauses. This yields read and write access to database contents accessible to the application's database user. The vulnerability requires authentication but no user interaction, which makes it suitable for lateral movement from any low-privileged account.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Query parameter values destined for the in and not_in operators were concatenated into SQL rather than bound as parameters. Any single-quote, comment sequence, or SQL keyword embedded in the input is interpreted by the database engine.

Attack Vector

Exploitation occurs over the network against the Payload CMS query API. The attacker authenticates with any valid account, then issues a request containing malicious payloads in the where[field][in] or where[field][not_in] query parameters. The server renders these values into SQL executed against the backend database.

For technical reproduction details, consult the CERT Security Advisory CVE-2026-63316 and the GitHub Security Advisory GHSA-pj7x-6wpf-pgvp.

Detection Methods for CVE-2026-63316

Indicators of Compromise

Query strings containing SQL metacharacters such as single quotes, --, ;, /*, or UNION inside where[*][in] or where[*][not_in] parameters
Unexpectedly long or URL-encoded values in Payload CMS API query parameters
Database error messages or stack traces returned to authenticated API clients
Spikes in request volume to Payload CMS collection endpoints from a single authenticated session

Detection Strategies

Enable verbose request logging on the Payload CMS application and parse logs for in and not_in parameters containing non-alphanumeric payloads
Deploy a web application firewall rule that inspects query parameters for SQL injection signatures targeting the where[...][in] syntax
Correlate authenticated API traffic with database query logs to identify anomalous SELECT, UNION, or schema-reading statements

Monitoring Recommendations

Monitor database audit logs for queries referencing information_schema, pg_catalog, or system tables originating from the Payload CMS service account
Alert on authenticated users generating malformed query parameters at high rates
Track outbound data volumes from the database host for signs of bulk exfiltration

How to Mitigate CVE-2026-63316

Immediate Actions Required

Upgrade Payload CMS to version 3.90.0 or 4.0.0-canary.34 or later without delay
Audit application logs for prior exploitation attempts against in and not_in query parameters
Rotate any secrets, API keys, or credentials that may have been stored in the Payload CMS database
Review user accounts and revoke sessions that exhibited suspicious query activity

Patch Information

The vendor fixed the vulnerability in Payload CMS 3.90.0 and 4.0.0-canary.34. Refer to the GitHub Security Advisory GHSA-pj7x-6wpf-pgvp for complete patch metadata and upstream commit references.

Workarounds

Restrict access to the Payload CMS API to trusted networks until patching is complete
Deploy a WAF rule that blocks SQL metacharacters inside where[*][in] and where[*][not_in] query parameters
Enforce least privilege on the database account used by Payload CMS to limit the blast radius of successful injection

bash

# Upgrade Payload CMS to a patched release
npm install payload@3.90.0
# or for the 4.x canary track
npm install payload@4.0.0-canary.34