CVE-2026-105849: Payload is a free and open source headless content management system

Q: How do I fix CVE-2026-105849?

payload: upgrade to 3.90.0. Exact commands for each OS are on this page.

Q: Is CVE-2026-105849 being exploited?

CVE-2026-105849 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-105849 affect?

CVE-2026-105849 affects payload. Severity is high (CVSS 8.3). Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with us

Routine

HIGH 8.3UPGRADE

CVE-2026-105849 is a high-severity flaw (CVSS 8.3) affecting payload. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	8.3 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.3% (top 77%)
CISA exploited list	No
Weakness	CWE-201, CWE-862
Published	2026-10-06
Last modified	2026-10-15

Publisher (CNA): GitHub, Inc. · Vendor: payloadcms

Last updated 2026-10-15 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-10-06 17:17 UTCPublished CVE record published
2026-10-15 00:13 UTCUpdated Record last modified

payloadcms payload UPGRADE

Affected: >= 3.0.0 and < 3.90.0 · 4.0.0 canary0 · 4.0.0 canary1 · 4.0.0 canary10 · 4.0.0 canary11 · 4.0.0 canary12 · 4.0.0 canary13 · 4.0.0 canary14

Fixed in: 3.90.0

Safe to downgrade to: a release before 3.0.0

1. Check installed version

npm ls payload

2. UPGRADE to 3.90.0

npm install payload@">=3.90.0"

3. If no update is available yet, DOWNGRADE to a release before 3.0.0

npm view payload versions npm install payload@"<3.0.0"

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-105849?

payload: upgrade to 3.90.0. Exact commands for each OS are on this page.

Is CVE-2026-105849 being exploited?

CVE-2026-105849 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-105849 affect?

CVE-2026-105849 affects payload. Severity is high (CVSS 8.3). Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with us

How urgent is CVE-2026-105849?

Priority 35/100. High severity

Related CVEs

CVE-2026-34751 CRITICAL 9.1 UPGRADE Payload is a free and open source headless content management system
CVE-2026-34747 HIGH 8.5 UPGRADE Payload is a free and open source headless content management system
CVE-2026-34748 HIGH 8.7 UPGRADE Payload is a free and open source headless content management system
CVE-2026-34746 HIGH 7.7 UPGRADE Payload is a free and open source headless content management system
CVE-2026-34749 MEDIUM 5.4 UPGRADE Payload is a free and open source headless content management system

References

← Back to latest CVEs