{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/payload-v3.x--3.87.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"id":"CVE-2026-105849"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["payload (\u003e= 3.0.0 \u003c 3.90.0, \u003e= 4.0.0-canary.0 \u003c 4.0.0-canary.34)","Payload (\u003e= 3.0.0, \u003c 3.90.0)","Payload (\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.34)","Payload (3.0.0 - 3.89.9)","Payload (4.0.0-canary.0 - 4.0.0-canary.33)","Payload (3.0.0 \u003c= version \u003c 3.88.0, 4.0.0-canary.0 \u003c= version \u003c 4.0.0-canary.27)","Payload (v3.x \u003c 3.87.0)","Payload (v4.0.0-canary \u003c 4.0.0-canary.20)","Payload (\u003c 3.90.0, \u003e= 4.0.0-canary.0 \u003c 4.0.0-canary.34)","Payload (v3.0.0 to \u003c3.90.0)","Payload (v4.0.0-canary.0 to \u003c4.0.0-canary.34)","Payload (\u003c 3.90.0)","Payload (\u003c 3.90.0, \u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.34)"],"_cs_severities":["critical"],"_cs_tags":["information-disclosure","cms","authentication","web-application","cve-2026-105847","web-vulnerability","access-control","sqli","vulnerability","high-confidence-source","remote-code-execution","web-application-vulnerability","session-hijacking","credential-theft","cve-2026-105861","xss","web-security","file-deletion","path-traversal","content-management-system"],"_cs_type":"advisory","_cs_vendors":["Payload"],"content_html":"\u003cp\u003ePayload CMS versions prior to 3.90.0 and 4.0.0-canary.34 are vulnerable to an API key disclosure flaw, tracked as CVE-2026-105849. This vulnerability manifests in deployments where the \u003ccode\u003euseAPIKey\u003c/code\u003e authentication feature is enabled. Due to insecure access control logic, users who possess read access to documents within an authentication collection can view sensitive API keys belonging to other users. Because these keys hold the permissions of the target account, successful exploitation allows an attacker to masquerade as the compromised user until the key is rotated or disabled. This impacts organizations relying on Payload for authentication and document management, particularly those with permissive document access policies.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized users to retrieve valid API keys of other users, leading to account takeover. The impact is significant for applications where API keys manage sensitive operations or provide access to protected administrative functions. Users must immediately verify document read permissions and rotate any keys potentially exposed during the window of vulnerability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Payload CMS to version 3.90.0 or 4.0.0-canary.34 to patch CVE-2026-105849.\u003c/li\u003e\n\u003cli\u003eAudit document read permissions in the CMS and restrict access to authentication collections to authorized users only.\u003c/li\u003e\n\u003cli\u003eDisable the \u003ccode\u003euseAPIKey\u003c/code\u003e feature if not strictly required for application functionality.\u003c/li\u003e\n\u003cli\u003ePerform a mandatory rotation of all active API keys generated while the affected versions were in use to mitigate potential unauthorized access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-07T22:50:22Z","date_published":"2026-10-06T18:47:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-payload-api-key-disclosure/","summary":"A vulnerability in Payload CMS versions 3.x and 4.x-canary allows unauthorized users with document read permissions to access active API keys stored within authentication collections.","title":"Payload API Key Disclosure via Document Read Access","url":"https://feed.craftedsignal.io/briefs/2026-10-payload-api-key-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Payload (V3.x \u003c 3.87.0)","version":"https://jsonfeed.org/version/1.1"}