Payload CMS CVE-2026-105853

Exploitation requires (1) a valid authenticated session/token for an affected Payload authentication collection (PR:L), and (2) that collection to define hidden or read-restricted fields - per the GHSA advisory, 'You are affected if an authentication collection contains hidden or read-restricted fields.' The attacker triggers the leak via the token refresh or password reset responses, which failed to apply field access and hidden-field filtering before the fix. LIMITING FACTORS: credentials are mandatory (no unauthenticated path), the affected collection must actually contain protected fields (default configurations with only visible fields are not exposed), and only Payload npm versions >= 3.0.0 < 3.90.0 and >= 4.0.0-canary.0 < 4.0.0-canary.34 are vulnerable. Note also that custom authentication strategies remain responsible for their own filtering even after upgrade.

This is a moderate-severity information disclosure flaw (CWE-200) with a vendor-supplied CVSS 4.0 vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N (7.1). All signals point to a real but bounded risk rather than an urgent emergency. The network vector (AV:N) and low attack complexity (AC:L) favor exploitability, but PR:L confirms the attacker must already hold valid credentials for an affected authentication collection - this is not an unauthenticated breach. Impact is confined to confidentiality (VC:H with VI:N/VA:N), consistent with the description: refresh and password-reset responses leaking hidden or read-restricted user fields. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied; absence of these means there is no public exploit identified at time of analysis and no evidence of active exploitation. The primary limiting factor is that the issue only matters when an auth collection actually contains hidden or read-restricted fields (per the GHSA advisory), so environments using only default/visible user fields are not exposed. Overall this is a legitimate patch-worthy issue for affected Payload deployments but, lacking any exploitation-probability or KEV signal and requiring prior authentication plus a specific collection configuration, it does not rise to drop-everything priority.

An authenticated low-privilege user of a Payload-based application whose user/auth collection defines hidden or read-access-restricted fields (e.g., internal flags, PII, role metadata) calls the token refresh or password reset endpoint. The response returns the full user document without applying field-level access or hidden-field filtering, disclosing data the caller was never authorized to read. No public exploit code was identified; exploitation requires only standard authenticated API calls over the network (AV:N/AC:L).