Live › vulnerability › CVE-2026-105861
Go to dashboardPayload CMS sends authentication data to unverified destinations when external URL-based upload retrieval is enabled. An attacker who can get an authenticated request to trigger an upload fetch can receive the victim's valid session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| payload | npm | >= 3.0.0, < 3.90.0 | 3.90.0 |
| payload | npm | >= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
| payloadcms payload | vendor | >= 3.0.0, < 3.90.0 | 3.90.0 |
| payloadcms payload | vendor | = 4.0.0 | – |
npm ls payload to see the installed version; affected if 3.x < 3.90.0 or < 4.0.0-canary.x4.0.0-canary.343.90.0 or >= 4.0.0-canary.34Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient.
You are affected if:
Payload now validates the destination before forwarding authentication data and reapplies that validation when a request changes destination.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
It is recommended to update all Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
If you cannot, a valid workaround exists:
This page as .md · .json · in your agent: get_signal("CVE-2026-105861")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.