~ / search / GHSA-fpww-c55p-cjv6

GHSA-fpww-c55p-cjv6

Payload: Polymorphic join queries could disclose hidden fields

Source: GitHub Advisory Database (reviewed) High CVE-2026-105847

Packages

EcosystemPackageAffectedFixed in
npm payload >= 3.0.0, < 3.90.0 3.90.0
npm payload >= 4.0.0-canary.0, < 4.0.0-canary.34 4.0.0-canary.34

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens. You are affected if: - You use an affected Payload version. - Users can query a collection with a polymorphic join to sensitive fields. ### Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds There is no complete workaround. Restricting read access to sensitive collections reduces exposure but does not replace upgrading.

References

External links from the advisory. They lead to third-party sites.