CVE-2026-105853: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in payloadcms payload
Description
## Impact Token refresh and password reset responses could return fields that the requesting user did not have access to. You are affected if: - An authentication collection contains hidden or read-restricted fields. ## Patches Authentication responses now apply field access and hidden-field filtering before returning user documents. Full user documents remain available server-side for access control. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. Custom authentication strategies remain responsible for filtering user documents returned through custom responses. ## Workarounds There is no complete workaround. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
CVSS v4.0
Score 7.1high
Affected software
payloadcms
payload
pkg:github/payloadcms/payloadRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PayloadCMS, a headless content management system, has a vulnerability identified as CVE-2026-105853 (CWE-200) affecting versions >=3.0.0 <3.90.0 and >=4.0.0-canary.0 <4.0.0-canary.34. The flaw causes token refresh and password reset API responses to leak hidden or read-restricted fields that the requesting user is not authorized to access. This exposure of sensitive information can occur without user interaction or elevated privileges beyond low privileges. The issue is resolved in versions 3.90.0 and 4.0.0-canary.34.
Potential Impact
Unauthorized actors with low privileges can receive sensitive information in token refresh and password reset responses that should be hidden or restricted. This exposure can lead to information disclosure, potentially aiding further attacks or unauthorized data access. The CVSS 4.0 score of 7.1 (high) reflects the network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.
Mitigation Recommendations
Upgrade PayloadCMS to version 3.90.0 or later, or to 4.0.0-canary.34 or later for canary releases. These versions contain the official fix that prevents exposure of hidden or read-restricted fields in token refresh and password reset responses. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-05T23:06:29.748Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac51f772cdf04f656c32848
Added to database: 10/06/2026, 16:19:03 UTC
Last enriched: 10/06/2026, 16:33:14 UTC
Last updated: 10/06/2026, 21:42:11 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.