UpHeron
All vulnerabilities

Servers and applications

CVE-2026-105847

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Severity
High 7.1
Published
6 Oct 2026
Last changed
15 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.90.0
Sources
NVD

Affected software

SoftwareAffected versions
Payload CMSServers and applications · cpe:a:payloadcms:payload
  • Version 4.0.0-canary33
  • Version 4.0.0-canary32
  • Version 4.0.0-canary31
  • Version 4.0.0-canary30
All 35 release lines
  • From 3.0.0 before 3.90.0
  • Version 4.0.0-canary0
  • Version 4.0.0-canary1
  • Version 4.0.0-canary2
  • Version 4.0.0-canary3
  • Version 4.0.0-canary4
  • Version 4.0.0-canary5
  • Version 4.0.0-canary6
  • Version 4.0.0-canary7
  • Version 4.0.0-canary8
  • Version 4.0.0-canary9
  • Version 4.0.0-canary10
  • Version 4.0.0-canary11
  • Version 4.0.0-canary12
  • Version 4.0.0-canary13
  • Version 4.0.0-canary14
  • Version 4.0.0-canary15
  • Version 4.0.0-canary16
  • Version 4.0.0-canary17
  • Version 4.0.0-canary18
  • Version 4.0.0-canary19
  • Version 4.0.0-canary20
  • Version 4.0.0-canary21
  • Version 4.0.0-canary22
  • Version 4.0.0-canary23
  • Version 4.0.0-canary24
  • Version 4.0.0-canary25
  • Version 4.0.0-canary26
  • Version 4.0.0-canary27
  • Version 4.0.0-canary28
  • Version 4.0.0-canary29
  • Version 4.0.0-canary30
  • Version 4.0.0-canary31
  • Version 4.0.0-canary32
  • Version 4.0.0-canary33

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-105847
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-105847