Payload CMS CVE-2026-105852

Exploitation requires a specific schema and deployment shape: the application must expose a queryable/readable collection that defines a relationship, has-many relationship, upload, or join field pointing to a second collection whose read access is restricted via access.read where constraints. The attacker leverages the 'contains' query operator against that related field so the nested lookup resolves protected related documents without inheriting the parent's access constraints. Limiting factors: (1) the vulnerable configuration (a readable collection related to an access-restricted collection) must exist - deployments without such relationships are unaffected; (2) the attacker must be able to query the readable collection, so the unauthenticated (PR:N) rating holds only if that collection is public; (3) on the evidence provided, the demonstrated code path is the MongoDB adapter; (4) impact is limited to disclosure of related-document information, not modification. There is no complete workaround per the vendor - upgrading to >= 3.90.0 or >= 4.0.0-canary.34 is required.

This is a medium-severity information-disclosure flaw (vendor CVSS 4.0 base 6.9; my independent CVSS 3.1 assessment is 5.3). The signals are internally consistent but modest: the CVSS vector indicates network reach (AV:N), low complexity (AC:L), no user interaction (UI:N), and only a limited confidentiality impact (VC:L / C:L) with no integrity or availability effect. The vendor set PR:N (unauthenticated), which is accurate ONLY when the exposed 'readable' collection is genuinely public - if the readable collection itself requires auth, real-world exploitation is authenticated, so treat PR:N as config-dependent rather than universal. No EPSS score, no SSVC decision data, and no CISA KEV entry were provided, and there is no public exploit identified at time of analysis; however, the fixing commit is public, which fully reveals the root cause (unchecked nested 'contains' relationship/join queries in the MongoDB query builder) and lowers the bar for exploit development. Conflict to note: the 'Authentication Bypass' tag overstates this - CWE-862 and the advisory describe an authorization/access-control bypass (access.read where constraints), not an authentication bypass. Net: a legitimate but non-emergency priority - patch affected deployments promptly, but this is not a widespread drive-by threat and leaks only related-document information, not full database contents.

An attacker with the ability to query a public/readable Payload collection crafts a filter on a relationship (or join/has-many/upload) field pointing to a second collection that is protected by access.read where constraints, using the nested 'contains' query operator. Because the related-document lookup did not apply the parent's access constraints, the response reveals whether protected related documents match the attacker's filter, allowing the attacker to probe and infer the contents of records they should not be able to read. No public exploit code is identified at time of analysis, but the fixing commit publicly discloses the exact vulnerable query path.