CVE-2026-105849: CWE-201: Insertion of Sensitive Information Into Sent Data in payloadcms payload
Description
### Impact Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: - An authentication collection enables `useAPIKey`. - Users have read access to other user documents containing active API keys. ### Patches Users should upgrade payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds Disable `useAPIKey` or restrict users to reading only their own authentication document. Rotate any API key that may have been exposed.
CVSS v4.0
Score 7.7high
Affected software
payloadcms
payload
pkg:github/payloadcms/payloadRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Payload CMS, a headless content management system, has a vulnerability (CVE-2026-105849) classified under CWE-201 and CWE-862. In affected versions, users with ordinary read access to authentication documents in collections with useAPIKey enabled can retrieve active API keys. These keys grant the ability to perform actions with the permissions of the target accounts until the keys are rotated or disabled. This vulnerability affects versions >=3.0.0 <3.90.0 and >=4.0.0-canary.0 <4.0.0-canary.34 and is resolved in versions 3.90.0 and 4.0.0-canary.34.
Potential Impact
An attacker with read access to authentication documents can obtain active API keys, allowing them to act with the permissions of the compromised accounts. This can lead to unauthorized access and actions within the system until the keys are rotated or disabled. The vulnerability has a CVSS 4.0 score of 7.7 (high severity), indicating significant risk if exploited.
Mitigation Recommendations
Upgrade Payload CMS to version 3.90.0 or later, or to 4.0.0-canary.34 or later, where this vulnerability is fixed. Until then, rotate or disable API keys regularly to limit the window of exposure. No other specific mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-05T23:06:29.747Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac51f772cdf04f656c32844
Added to database: 10/06/2026, 16:19:03 UTC
Last enriched: 10/06/2026, 16:33:26 UTC
Last updated: 10/06/2026, 21:42:11 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.