UpHeron
All vulnerabilities

Servers and applications

CVE-2023-30843

Hidden fields can be leaked on readable collections

Severity
Medium 6.5
Published
26 Apr 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.7.0
Also known as
GHSA-35jj-vqcf-f2jf
Sources
NVD, Project advisories (GitHub)

Description

Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden…

Affected software

SoftwareAffected versions
Payload CMSServers and applications · cpe:a:payloadcms:payload
  • Every version before 1.7.0
Payload CMSServers and applications · github:payloadcms/payload
  • Every version before 1.7.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-30843
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-30843
  • GitHub Advisory Database https://github.com/advisories/GHSA-35jj-vqcf-f2jf
  • github.com https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf