{"vulnerability": "CVE-2026-105852", "sightings": [{"uuid": "a9be2367-14a2-4be8-9f3f-3096aa729455", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105852", "type": "seen", "source": "https://gist.github.com/alon710/998c7ae5221e09a204349281b20d659e", "content": "# CVE-2026-105852: CVE-2026-105852: Authorization Bypass and Related-Document Oracle in Payload CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105852\n\n## Summary\nAn authorization bypass vulnerability in Payload CMS enables unauthenticated attackers to query and infer the existence of restricted documents via nested relationship queries on public collections. This cross-document contamination flaw affects both MongoDB and Drizzle SQL database adapters, allowing unauthorized reads of relationship metadata.\n\n## TL;DR\nUnauthenticated attackers can bypass read-access controls on restricted collections via nested query parameters on related public collections, leaking metadata and confirming document existence.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 5.3 (Medium)\n- **EPSS Score**: Not Available\n- **Impact**: Information Disclosure / Related-Document Oracle\n- **Exploit Status**: Proof of Concept (PoC) documented in integration test suite\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Payload CMS (npm package: payload)\n- **payload**: < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0 < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade Payload CMS dependencies to versions 3.90.0 or 4.0.0-canary.34 and above.\n- Identify relationship, upload, or join fields pointing to restricted collections and restrict querying capabilities.\n- Apply strict field-level access control policies on relations to prevent unauthenticated field lookup.\n\n**Remediation Steps:**\n1. Open the package configuration file (package.json) and verify all payload-related packages.\n2. Run 'npm install payload@latest' or equivalent to update dependency mappings.\n3. Audit application schemas for nested relationship queries and implement query validation layers.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/payloadcms/payload/security/advisories/GHSA-7c34-32v3-j575)\n- [Official Fix Commit Patch](https://github.com/payloadcms/payload/commit/94059cf4bc6170ce88453015c0c6551329ae3982)\n- [Payload v3.90.0 Release Notes](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n- [CVE-2026-105852 National Vulnerability Database Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-105852)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105852) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T22:30:31.000000Z"}]}