EUVD-2026-93503
GHSA-f7hx-52q9-hcrf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network endpoint, low complexity; CWE-639 authorization bypass implies at least a low-privilege account (PR:L); impact limited to unauthorized reordering, so I:L and no C/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 2 npm packages depend on payload (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.0.0-canary.0.
DescriptionCVE.org
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
AnalysisAI
Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that writes document order changes without evaluating collection or field-level update access control, allowing a caller who can reach that endpoint to alter the sort position of documents in any collection or join field that has the orderable option enabled. The vendor's own fix commit confirms the pre-patch endpoint accepted arbitrary orderableFieldName values and performed the underlying update with access checks bypassed (overrideAccess true), and the post-fix code now rejects unconfigured fields with HTTP 400 and re-runs executeAccess per document, so exploitation depends on the orderable feature being explicitly configured and the achievable impact is confined to the ordering field rather than arbitrary document content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the `orderable` option to be enabled on a target collection or on a join field - this is the concrete, product-specific precondition; the post-fix code even rejects requests for fields 'not configured for ordering' with HTTP 400. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input assigns CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the source-code evidence contradicts the triple-High impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Payload 3.90.0 (or 4.0.0-canary.34 for canary users), which validates that orderableFieldName is actually configured for ordering, re-evaluates collection.access.update for every document being moved, and applies updates with overrideAccess: false; see https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf and https://github.com/payloadcms/payload/releases/tag/v3.90.0, with the fixing change at https://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Payload CMS deployment and record the exact version, flagging anything below 3.90.0 (or below 4.0.0-canary.34 on canary builds); determine whether the orderable option is enabled on any collection or join field, since the flaw is only reachable where it is configured, and where it is enabled restrict access to the reorder endpoint at the reverse proxy or WAF and review recent access logs for anomalous reorder requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbit
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker sub
Malformed multipart request bodies sent to Payload CMS versions 3.0.0 through 3.89.x and 4.0.0-canary.0 through 4.0.0-ca
Authenticated users who can update an auth collection document in Payload CMS can change the password field on that docu
Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the
Payload CMS prior to 3.73.0 has a SQL injection vulnerability when querying structured data, enabling database compromis
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote
Payload CMS (npm package `payload`) versions 3.0.0 through 3.89.x and 4.0.0-canary builds before canary.34 hash account
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access t
Authentication claim injection in Payload CMS affects versions after 3.0.0 and before 3.90.0, where a collection field c
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Str
Stored Cross-Site Scripting (XSS) in Payload CMS versions prior to 3.78.0 allows authenticated users with write permissi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today