Payload CMS CVE-2026-105847

Requires an authenticated user holding query access (PR:L) to a Payload collection that is configured with a polymorphic join relationship referencing a collection containing hidden or read-restricted fields (e.g. password-reset tokens); the attacker abuses the polymorphic join 'where' filter, which prior to the fix failed to validate unknown field paths. Exploitation is limited by: the need for a valid authenticated account, the requirement that a polymorphic join to sensitive fields actually exists in the schema, and the affected version window (Payload >=3.0.0 <3.90.0 or >=4.0.0-canary.0 <4.0.0-canary.34). There is no complete workaround; restricting read access to sensitive collections only reduces exposure, so patching is required.

This is a genuine but moderate-priority information-disclosure flaw (CWE-200) in Payload CMS. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) is internally consistent with the description: it is remotely reachable over the normal query API, low attack complexity, requires authenticated low-privilege access (PR:L), needs no user interaction, and has high confidentiality impact with no integrity or availability impact - matching the leak of hidden/read-restricted values including password-reset tokens. No EPSS score, KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active exploitation or weaponization; this is a high-confidentiality-impact bug without a confirmed exploitation signal. The practical risk is tempered by two prerequisites that are NOT reflected in the raw score: the attacker must already hold query access (an authenticated/low-priv account), and the target collection must expose a polymorphic join to sensitive fields. The password-reset-token angle is the most concerning real-world impact, since inferring a reset token can enable downstream account takeover even though this CVE itself only scores confidentiality. Treat as a should-patch-soon issue for exposed/multi-tenant Payload deployments rather than an emergency, and note the signal gap: no exploitation probability data was supplied, so prioritization leans on impact and ease-of-access rather than observed exploitation.

An authenticated low-privilege user with query access sends crafted polymorphic join 'where' filters against a collection, using equality/comparison operators to blind-infer the values of hidden or read-restricted fields (such as another user's password-reset token) that are not normally returned. No public exploit code was identified at time of analysis, but the fixing commit and its regression tests effectively document the exact malicious query shape. Because the CVSS vector is PR:L, this requires an existing authenticated account and is not anonymous.