Payload relationship-query authorization bypass

高 7.5CVE-2026-105852 · GHSA-7c34-32v3-j575 · 06/10/2026 公開 · 15/10/2026 更新

要点

CVE-2026-105852 は payload (payloadcms), payload に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.27%（全脆弱性の 19.0% より高い）。
対処：3.90.0, 4.0.0-canary.34 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
payload payloadcms	`= 4.0.0< 3.90.0`	`3.90.0`
payload npm	`≥ 4.0.0-canary.0, < 4.0.0-canary.34< 3.90.0`	`4.0.0-canary.343.90.0`

概要

Impact

A readable collection could expose information about protected documents in a related collection.

You are affected if:

You expose a readable collection with a relationship to a collection protected by access.read where constraints.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

There is no complete workaround. Upgrade Payload packages >= 3.90.0 or >= 4.0.0-canary.34.

NVD の説明

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.