---
id: CVE-2026-105849
title: Payload is a free and open source headless content management system
summary: >-
  Payload is a free and open source headless content management system. In
  versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34,
  users with ordinary read access to other authentication documents in a
  collection with…
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'
cwe:
  - CWE-201
  - CWE-862
vendor: payloadcms
product: payload
affected:
  - 'payload >= 3.0.0, < 3.90.0'
  - payload = 4.0.0
patched:
  - payload 3.90.0
published: '2026-10-06'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T00:13:10.917'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105849'
references:
  - url: >-
      https://github.com/payloadcms/payload/commit/880d2e900be22cd66a9e939f2b3e702fa413180f
    label: security-advisories@github.com
  - url: 'https://github.com/payloadcms/payload/releases/tag/v3.90.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/payloadcms/payload/security/advisories/GHSA-238x-w2j9-gwwr
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-238x-w2j9-gwwr'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
epss: 0.003
epssPercentile: 0.22608
aliases:
  - GHSA-238x-w2j9-gwwr
ecosystem: npm
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-06T17:26:14.965583Z'
scores:
  nvd: 8.3
  cna: 7.7
ingestedAt: '2026-10-06T17:09:22.182Z'
---

## Overview

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

## Affected

- `payload >= 3.0.0, < 3.90.0`
- `payload = 4.0.0`

## Remediation

Upgrade past the affected range:

- `payload 3.90.0`

## Package advisory (CVE-2026-105849)

Affected packages:

- `payload >= 3.0.0, < 3.90.0`
- `payload >= 4.0.0-canary.0, < 4.0.0-canary.34`

Patched in:

- `payload 3.90.0`
- `payload 4.0.0-canary.34`

Source: https://github.com/advisories/GHSA-238x-w2j9-gwwr