CVE-2026-105849

HighCVSS 8.3/10Last modified Oct 15, 2026

Description

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-201CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Oct 6, 2026
Last modified
Oct 15, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-105855.4A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to execute arbCVE-2026-1058508.2Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versCVE-2026-1058518.1Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-CVE-2026-1058527.5Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, CVE-2026-1058536.5Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-CVE-2026-1058547.5Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-CVE-2026-1058557.1Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, CVE-2026-1058568.3Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create CVE-2026-10585710.0Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary vCVE-2026-1058588.1Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, CVE-2026-1058599.8Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, CVE-2026-105867.2The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forg
CVE-2026-105849: High severity, CVSS 8.3 | Vulnix