Payloadcms Payload vulnerabilities

CVE-2026-27567 [MEDIUM] CWE-918 CVE-2026-27567: Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network re

CVE-2026-105804 [MEDIUM] CWE-916 CVE-2026-105804: Payload is a free and open source headless content management system. Payload versions from 3.0.0 be Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes. This issue is fixed in ver

CVE-2026-93363 [MEDIUM] CWE-862 CVE-2026-93363: The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint without possessing the required collection access permissi

CVE-2026-105864 [MEDIUM] CWE-863 CVE-2026-105864: Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-te Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing document