{"vulnerability": "GHSA-fpww-c55p-cjv6", "sightings": [{"uuid": "293fe3ea-cd13-4a8d-822a-04e20dd08982", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-fpww-c55p-cjv6", "type": "seen", "source": "https://gist.github.com/alon710/6ad8b8a1985e2a964c1c257370b5af39", "content": "# CVE-2026-105847: CVE-2026-105847: Information Disclosure via Polymorphic Join Queries in Payload CMS\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105847\n\n## Summary\nPayload CMS is subject to an information disclosure vulnerability where users with query permissions can bypass field-level access controls. By leveraging polymorphic join filters, an attacker can perform blind-inference queries to retrieve restricted or hidden fields such as password reset tokens.\n\n## TL;DR\nA validation bypass in Payload CMS's polymorphic join filters allows authenticated users to query and infer the values of hidden or restricted fields.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.1 (High)\n- **EPSS Score**: N/A\n- **Impact**: Information Disclosure / Privilege Escalation\n- **Exploit Status**: Proof-of-Concept / Test-Suite Level\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Payload CMS\n- **payload**: >= 3.0.0, < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade Payload CMS to version 3.90.0 or later.\n- Upgrade Payload CMS 4.x canary to 4.0.0-canary.34 or later.\n- Disable or restrict polymorphic joins using beforeOperation hooks.\n- Deploy WAF rules to inspect and sanitize polymorphic join parameters.\n\n**Remediation Steps:**\n1. Identify all instances of the payload package in package.json.\n2. Update the package version to ^3.90.0 or newer.\n3. Run package manager update command (e.g., npm install or pnpm update).\n4. Verify that polymorphic joins to restricted fields are rejected with a 400 Bad Request.\n\n## References\n\n- [GitHub Fix Commit](https://github.com/payloadcms/payload/commit/caa3f69b5aecc6e7c2b459ed87972cbca9f33ee5)\n- [GitHub Security Advisory (GHSA-fpww-c55p-cjv6)](https://github.com/payloadcms/payload/security/advisories/GHSA-fpww-c55p-cjv6)\n- [Payload CMS v3.90.0 Release Notes](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n- [NVD Security Reference](https://nvd.nist.gov/vuln/detail/CVE-2026-105847)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105847) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T06:30:29.000000Z"}]}