Payload CMS EUVD-2026-98471

Exploitation requires ALL of: (1) use of a vulnerable database adapter - @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite (< 3.90.0), or @payloadcms/db-postgres or @payloadcms/db-vercel-postgres (< 3.73.0); (2) a readable collection containing a 'json' field OR a 'blocks' field configured with blocksAsJSON: true (richText fields are explicitly NOT affected); and (3) an attacker holding read PLUS create-or-update access on that collection. The injection is delivered through the 'in' and 'not_in' query parameters/operators targeting a specific field-path shape. Limiting factors: the authentication requirement (not anonymous), the non-default dependency on json/blocksAsJSON field types, and the specific SQLite/Postgres adapter requirement - instances with no json or blocksAsJSON fields, or already on patched versions, are not affected.

This is a genuine, moderately-high priority issue for affected deployments, but with meaningful preconditions that temper the raw CVSS 4.0 base score of 8.7 (High). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) indicates a network-reachable, low-complexity SQL injection requiring low privileges and no user interaction, with high confidentiality and integrity impact - consistent with CWE-89. The authenticated requirement (PR:L) is the key risk limiter: the attacker must already possess read PLUS create-or-update access to a vulnerable collection, so this is not an anonymous internet-wide exploit. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is a signal to reconcile: the GHSA advisory lists different fixed versions per package (db-postgres/db-vercel-postgres fixed in 3.73.0; db-sqlite/db-d1-sqlite fixed in 3.90.0) while the CVE description and NVD cite 3.90.0/4.0.0-canary.34 globally - defenders should map the fix version to their specific database adapter rather than assuming a single version. Overall this warrants prompt patching where the affected adapters and json/blocksAsJSON field conditions are met, but it is not a drop-everything internet-facing crisis given the authentication and configuration prerequisites.

A low-privileged but legitimate user of a Payload CMS instance (e.g. a content editor with read and create/update rights on a collection containing a json or blocksAsJSON blocks field) submits an API request manipulating the 'in' or 'not_in' query operators to inject SQL against the SQLite or Postgres backend. By crafting the field-path shape and operators, they extract or alter data beyond their intended authorization. No public proof-of-concept is referenced, and the attack requires valid authenticated access to the targeted collection.