Vendor
Payload Storage-S3 Object Overwrite Vulnerability
1 TTP 1 CVEAn authenticated user can exploit a path configuration weakness in @payloadcms/storage-s3 to overwrite arbitrary S3 objects across collections, bypassing security controls.
Authorization Bypass in @payloadcms/plugin-multi-tenant
1 TTP 1 CVEAn authorization vulnerability in @payloadcms/plugin-multi-tenant allows authenticated users to assign themselves to unauthorized tenants by leveraging default field access configurations.
SQL Injection in Payload CMS SQLite and Postgres Adapters
1 TTP 1 CVEAn improper input sanitization vulnerability in Payload CMS database adapters allows attackers with collection access to execute SQL injection attacks via JSON and block fields.
Remote Code Execution in @payloadcms/plugin-form-builder
1 CVEA critical remote code execution vulnerability (CVE-2026-105857) in @payloadcms/plugin-form-builder allows unauthenticated attackers to execute arbitrary code via crafted form submissions.
Improper Access Control in Payload CMS MCP Plugin
1 CVEAn improper access control vulnerability (CVE-2026-105806) in the @payloadcms/plugin-mcp package allows authenticated users to manage API keys across accounts, facilitating privilege escalation and account takeover.
Payload API Key Disclosure via Document Read Access
9 TTPs 1 CVEA vulnerability in Payload CMS versions 3.x and 4.x-canary allows unauthorized users with document read permissions to access active API keys stored within authentication collections.
Prototype Pollution Vulnerability in Payload Import Export Plugin
2 TTPs 1 CVEAn unauthenticated prototype pollution vulnerability in the Payload Import Export plugin allows remote attackers to achieve code execution via malicious input.