Skip to content
Threat Feed
Subscribe

Product

Payload (3.0.0 <= Version < 3.88.0, 4.0.0-Canary.0 <= Version < 4.0.0-Canary.27)

1 brief RSS
critical advisory

Payload API Key Disclosure via Document Read Access

A vulnerability in Payload CMS versions 3.x and 4.x-canary allows unauthorized users with document read permissions to access active API keys stored within authentication collections.

payload +12 information-disclosure cms authentication web-application cve-2026-105847 web-vulnerability access-control sqli +12
9t 1c updated