EUVD-2026-93501
GHSA-r488-j9vj-wx3q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Supplied commit only broadens-then-restricts read access to any logged-in user, so PR:L and confidentiality-only (C:H, I:N, A:N); no code-execution or scope-change evidence supports the input's RCE/S:C claim.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
AnalysisAI
Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the @payloadcms/plugin-form-builder plugin before 3.90.0 (and 4.0.0-canary versions before 4.0.0-canary.34) is achievable by an authenticated non-admin user, based on the vendor patch, which replaces a permissive 'any logged-in user' read rule with a check that the requester belongs to the configured admin user collection. The published CVE record characterizes the flaw as remote code execution (CWE-94, CVSS 10.0), but the actual shipped fix is an access-control tightening on the Forms and FormSubmissions collections plus tests asserting that users from unrelated collections are denied, so the verifiable impact is a confidentiality breach of form data rather than code execution; these conflicting signals should be reconciled with the vendor advisory before prioritization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the @payloadcms/plugin-form-builder plugin (version < 3.90.0, or canary < 4.0.0-canary.34) installed in a Payload CMS deployment with at least one form configured to accept submissions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict sharply and must be reconciled before prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade @payloadcms/plugin-form-builder to 3.90.0 or, on the canary line, to 4.0.0-canary.34; these are the exact versions cited in the advisory and release tag, and the fix is the access-control predicate in the generated Forms and FormSubmissions collections, so the plugin package must be updated and the application redeployed (regenerated collection config is what takes effect). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Payload CMS deployments using the @payloadcms/plugin-form-builder plugin and identify non-admin users who could exploit the access flaw; if immediate upgrade is not possible, disable the plugin or restrict read access to the Forms and FormSubmissions collections to admin users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbit
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker sub
Malformed multipart request bodies sent to Payload CMS versions 3.0.0 through 3.89.x and 4.0.0-canary.0 through 4.0.0-ca
Authenticated users who can update an auth collection document in Payload CMS can change the password field on that docu
Payload CMS prior to 3.73.0 has a SQL injection vulnerability when querying structured data, enabling database compromis
Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote
Payload CMS (npm package `payload`) versions 3.0.0 through 3.89.x and 4.0.0-canary builds before canary.34 hash account
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access t
Authentication claim injection in Payload CMS affects versions after 3.0.0 and before 3.90.0, where a collection field c
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Str
Stored Cross-Site Scripting (XSS) in Payload CMS versions prior to 3.78.0 allows authenticated users with write permissi
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today