| Package | Affected versions | Patched versions |
|---|---|---|
| payload | ≥ 4.0.0-canary.0, < 4.0.0-canary.27< 3.88.0 | 4.0.0-canary.273.88.0 |
Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read.
You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.
Payload now applies field-level access checks to sort fields before executing queries.
Users should upgrade to >= 3.88.0 or >= 4.0.0-canary.27.
Upgrading is recommended. Until then, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free