Product

Payload (V4.0.0-Canary.0 to <4.0.0-Canary.34)

1 brief RSS

Payload API Key Disclosure via Document Read Access

A vulnerability in Payload CMS versions 3.x and 4.x-canary allows unauthorized users with document read permissions to access active API keys stored within authentication collections.

payload +12 information-disclosure cms authentication web-application cve-2026-105847 web-vulnerability access-control sqli +12

9t 1c updated 1d ago