CVE-2026-105849

UNKNOWN 0.0

Payload: API key disclosure through ordinary document reads

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CWE	CWE-201 CWE-862
Vendor	payloadcms
Product	payload
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for payloadcms payload

Be the first to know when new unknown vulnerabilities affecting payloadcms payload are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

payloadcms / payload

>= 3.0.0, < 3.90.0 >= 4.0.0-canary.0, < 4.0.0-canary.34

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/payloadcms/payload/security/advisories/GHSA-238x-w2j9-gwwr github.com: https://github.com/payloadcms/payload/commit/880d2e900be22cd66a9e939f2b3e702fa413180f github.com: https://github.com/payloadcms/payload/releases/tag/v3.90.0