CVE-2026-105849

Payload: API key disclosure through ordinary document reads

State: Published
Severity: 7.7 High
Published: Oct 6, 2026
Updated: Oct 6, 2026
Reserved: Oct 5, 2026

Description

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-201 Insertion of Sensitive Information Into Sent Data
CWE-862 Missing Authorization

Affected Products

Product	Versions
payloadpayloadcms	>= 3.0.0, < 3.90.0Affected >= 4.0.0-canary.0, < 4.0.0-canary.34Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.