Product

Payload (V3.x < 3.87.0)

1 brief RSS

Payload API Key Disclosure via Document Read Access

A vulnerability in Payload CMS versions 3.x and 4.x-canary allows unauthorized users with document read permissions to access active API keys stored within authentication collections.

payload +12 information-disclosure cms authentication web-application cve-2026-105847 web-vulnerability access-control sqli +12

9t 1c updated 1d ago