All vulnerabilities
CVE-2026-105805GHSA-9g87-32v6-3c2r

Payload: Sort queries could expose protected field information

payloadcms payloadnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.88.0Also 4.0.0-canary.27GitHub
Published6 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

  • 3.88.0payload, npmGitHubnpm install payload@3.88.0
  • 4.0.0-canary.27payload, npmGitHubnpm install payload@4.0.0-canary.27

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read.

You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.

Patches

Payload now applies field-level access checks to sort fields before executing queries.

Users should upgrade to >= 3.88.0 or >= 4.0.0-canary.27.

Workarounds

Upgrading is recommended. Until then, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.

Text from GitHub Advisory Database

Affected versions 6

  • payload, npm< 3.88.0GitHub
  • payload, npm>= 4.0.0-canary.0, < 4.0.0-canary.27GitHub
  • payloadaffected: < 3.88.0CVE List
  • payloadaffected: >= 4.0.0-canary.0, < 4.0.0-canary.27CVE List
  • payload, npmfrom first release, fixed in 3.88.0OSV
  • payload, npmfrom 4.0.0-canary.0, fixed in 4.0.0-canary.27OSV

References 4