CVE-2026-105805

published 2026-10-06

CVE-2026-105805: Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user…

Priority P3 39 medium 6.9 CVSS 4.0

AV N AC L AT N PR N UI N VC L VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
payloadcms	payload	< 3.88.0	3.88.0
payloadcms	payload	—	—
payloadcms	payload	>= 0 < 3.88.0	3.88.0
payloadcms	payload	>= 4.0.0-canary.0 < 4.0.0-canary.27	4.0.0-canary.27

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200 CWE-863