~ / search / GHSA-7c34-32v3-j575

GHSA-7c34-32v3-j575

Payload relationship-query authorization bypass

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-105852

Packages

EcosystemPackageAffectedFixed in
npm payload < 3.90.0 3.90.0
npm payload >= 4.0.0-canary.0, < 4.0.0-canary.34 4.0.0-canary.34

Details

As written in the advisory (Markdown source, shown as plain text).

## Impact A readable collection could expose information about protected documents in a related collection. **You are affected if:** - You expose a readable collection with a relationship to a collection protected by access.read where constraints. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ## Workarounds There is no complete workaround. Upgrade Payload packages `>= 3.90.0` or `>= 4.0.0-canary.34`.

References

External links from the advisory. They lead to third-party sites.