Payload API Key Disclosure via Document Read Access

Payload CMS versions prior to 3.90.0 and 4.0.0-canary.34 are vulnerable to an API key disclosure flaw, tracked as CVE-2026-105849. This vulnerability manifests in deployments where the useAPIKey authentication feature is enabled. Due to insecure access control logic, users who possess read access to documents within an authentication collection can view sensitive API keys belonging to other users. Because these keys hold the permissions of the target account, successful exploitation allows an attacker to masquerade as the compromised user until the key is rotated or disabled. This impacts organizations relying on Payload for authentication and document management, particularly those with permissive document access policies.

Impact

Successful exploitation allows unauthorized users to retrieve valid API keys of other users, leading to account takeover. The impact is significant for applications where API keys manage sensitive operations or provide access to protected administrative functions. Users must immediately verify document read permissions and rotate any keys potentially exposed during the window of vulnerability.

Recommendation

• Upgrade Payload CMS to version 3.90.0 or 4.0.0-canary.34 to patch CVE-2026-105849.
• Audit document read permissions in the CMS and restrict access to authentication collections to authorized users only.
• Disable the useAPIKey feature if not strictly required for application functionality.
• Perform a mandatory rotation of all active API keys generated while the affected versions were in use to mitigate potential unauthorized access.