{"vulnerability": "CVE-2026-10585", "sightings": [{"uuid": "38fb6245-13fe-44d9-aba0-1f7d1a57db15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105857", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx7xisw4fy2h", "content": "\ud83d\udd34 CVE-2026-105857 - Critical (10)\n\nPayload is a free and open source headless content management system. In @payloadcms/plugin-form-...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105857/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-06T17:31:16.572025Z"}, {"uuid": "51858442-e432-47ad-9b85-43d31f3027ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105858", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx7xiziwia2a", "content": "\ud83d\udfe0 CVE-2026-105858 - High (8.1)\n\nPayload is a free and open source headless content management system. In versions before 3.90.0 a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105858/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-06T17:31:22.815626Z"}, {"uuid": "40323981-2af0-4cc8-b28b-99344ccbd667", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105855", "type": "seen", "source": "https://gist.github.com/alon710/f6b5203d332bd3a45b032a1ccf36e20d", "content": "# CVE-2026-105855: CVE-2026-105855: Privilege Escalation via Improper Access Control on Password Fields in Payload CMS\n\n> **CVSS Score:** 7.6\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105855\n\n## Summary\nAn Improper Access Control vulnerability (CWE-284) in Payload CMS prior to version 3.90.0 and 4.0.0-canary.34 allows authenticated, low-privileged users to bypass field-level access control restrictions and overwrite the password of other accounts, leading to complete account takeover and privilege escalation.\n\n## TL;DR\nAn authentication bypass and privilege escalation vulnerability in Payload CMS allows authenticated users to overwrite the passwords of other accounts, including administrators, due to premature password extraction prior to access control validation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.6 (High)\n- **EPSS Score**: Not Available\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Payload CMS\n- **payload**: < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0 < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade Payload CMS to a patched version (v3.90.0+ or v4.0.0-canary.34+)\n- Monitor API traffic for unauthorized PATCH/PUT requests targeting authentication endpoints\n- Audit collection access control configurations\n\n**Remediation Steps:**\n1. Open the project package.json file.\n2. Update the 'payload' dependency to '3.90.0' or newer (or '4.0.0-canary.34' or newer for canary users).\n3. Run the package manager install command (e.g., npm install, yarn install, or pnpm install).\n4. Verify the installed version in package-lock.json or yarn.lock.\n5. Deploy the updated application to production environments.\n\n## References\n\n- [Payload CMS Security Advisory GHSA-fx49-4h83-wjv9](https://github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9)\n- [Patch Commit 9de9e7911e29d60870a1d5480412524c63d6411e](https://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e)\n- [Payload CMS v3.90.0 Release Notes](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105855) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T17:30:31.000000Z"}, {"uuid": "b2ce85b6-cc72-4e0f-8ecf-5c0346176027", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105858", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4vb3a7po4uaqm", "content": "CVE-2026-105858 - Payload: Remote Code Execution through first-register\nCVE ID : CVE-2026-105858\n \n Published : Oct. 6, 2026, 4:29 p.m. | 58\u00a0minutes ago\n \n Description : Payload is a free and open source headless content management system. In versions before 3.90.0 and canary ...", "creation_timestamp": "2026-10-06T17:57:44.042270Z"}, {"uuid": "5d26b006-b8ca-460e-a70e-fa13b8d247f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105851", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx7zla7z2n24", "content": "\ud83d\udea8 CVE-2026-105851 \u2014 CVSS 9.3 CRITICAL\n\nPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105851\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-06T18:08:23.865646Z"}, {"uuid": "8b5480b4-c3c2-404f-8369-98ec4f94d7f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105859", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/44dspxcqop7fp", "content": "CVE-2026-105859 - Payload: Unauthorized update to collection documents\nCVE ID : CVE-2026-105859\n \n Published : Oct. 6, 2026, 4:31 p.m. | 56\u00a0minutes ago\n \n Description : Payload is a free and open source headless content management system. In versions before 3.90.0 and canary v...", "creation_timestamp": "2026-10-06T18:03:44.886226Z"}, {"uuid": "6fbe3dfc-3fac-4edb-8674-882414d66171", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105857", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx7zlilzvr2n", "content": "\ud83d\udea8 CVE-2026-105857 \u2014 CVSS 10 CRITICAL\n\nPayload is a free and open source headless content management system. In @payloadcms/plugin-form-builder ve...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105857\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-06T18:08:32.684849Z"}, {"uuid": "a5643dad-634c-481c-ba9e-06c8007915a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105859", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx7zlre7hh2q", "content": "\ud83d\udea8 CVE-2026-105859 \u2014 CVSS 9.8 CRITICAL\n\nPayload is a free and open source headless content management system. In versions before 3.90.0 and canary ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105859\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-06T18:08:41.979632Z"}, {"uuid": "fc33b7ef-81fe-4857-816d-4dbbfa592500", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105859", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxa22oxpck2s", "content": "\ud83d\udd34 CVE-2026-105859 - Critical (9.8)\n\nPayload is a free and open source headless content management system. In versions before 3.90.0 a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105859/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-06T18:17:03.052366Z"}, {"uuid": "c7a9e479-05af-4841-aee5-cfa0476a61d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105854", "type": "seen", "source": "https://gist.github.com/alon710/f9ae3e2b6d96e0c452aec46e66747943", "content": "# CVE-2026-105854: CVE-2026-105854: Regular Expression Denial of Service (ReDoS) and Uncontrolled Resource Consumption in Payload CMS\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105854\n\n## Summary\nPayload CMS, a popular open-source headless Content Management System, contains a critical Regular Expression Denial of Service (ReDoS) and uncontrolled resource consumption vulnerability in versions prior to 3.90.0 and canary versions prior to 4.0.0-canary.34. Due to nested quantifiers in the multipart boundary regex validation pattern, and the absence of streaming backpressure controls, remote attackers can trigger catastrophic backtracking and memory exhaustion. This blocks the single-threaded Node.js event loop, resulting in a persistent and complete Denial of Service (DoS).\n\n## TL;DR\nUnauthenticated remote attackers can freeze the Payload CMS Node.js event loop and exhaust heap memory by sending malformed multipart HTTP requests, exploiting a ReDoS flaw in the boundary regex parser and a lack of request size limits in stream processing.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333, CWE-400\n- **Attack Vector**: Network\n- **CVSS Score**: 8.7 (High)\n- **Exploit Status**: poc\n- **KEV Status**: not-listed\n- **Remediation Status**: patched\n\n## Affected Systems\n\n- Payload CMS open-source application server\n- **payload**: >= 3.0.0, < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade the Payload CMS dependencies to version 3.90.0 or higher.\n- Enforce maximum length limitations on the HTTP Content-Type header at the edge firewall or WAF layer.\n- Configure active stream timeouts on reverse proxies to interrupt hanging backend connections.\n\n**Remediation Steps:**\n1. Identify all deployed nodes running vulnerable versions of Payload CMS.\n2. Update the project package.json to pin payload to '^3.90.0' or higher.\n3. Run your package manager install command (e.g., 'npm install' or 'pnpm install') to update the lockfile.\n4. Redeploy the application to production and monitor server CPU utilization for ReDoS anomalies.\n\n## References\n\n- [Payload CMS Security Advisory GHSA-2g7p-5934-q4w7](https://github.com/payloadcms/payload/security/advisories/GHSA-2g7p-5934-q4w7)\n- [Payload CMS GitHub Release v3.90.0](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n- [CVE Official Record - CVE-2026-105854](https://www.cve.org/CVERecord?id=CVE-2026-105854)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105854) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T18:30:33.000000Z"}, {"uuid": "ade89168-8a84-4562-ade9-4c059556a2ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105850", "type": "seen", "source": "https://gist.github.com/alon710/053c345a4e98e24146f5e65d468ed9a0", "content": "# CVE-2026-105850: CVE-2026-105850: Race Condition and Order Double-Processing in @payloadcms/plugin-ecommerce\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105850\n\n## Summary\nA high-severity race condition vulnerability exists in @payloadcms/plugin-ecommerce within the Stripe payment adapter's order confirmation pipeline. Unauthenticated attackers or parallel webhook deliveries can exploit sequential, non-atomic database operations to bypass state verifications, leading to duplicate order creation, multiple inventory decrements, and inconsistent database records.\n\n## TL;DR\nSequential, non-atomic database operations in @payloadcms/plugin-ecommerce allow concurrent requests to bypass state verification checks, leading to duplicate order creation and inventory depletion.\n\n## Technical Details\n\n- **CWE ID**: CWE-837\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.8 (High)\n- **Impact**: High Integrity, High Availability (Duplicate Orders & Inventory Depletion)\n- **Exploit Status**: None (No public exploits in the wild)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- @payloadcms/plugin-ecommerce\n- payload\n- **@payloadcms/plugin-ecommerce**: < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade @payloadcms/plugin-ecommerce to version 3.90.0 or higher.\n- Generate and apply PostgreSQL database migrations to support the new transaction state.\n- Refactor custom payment adapters to use the centralized, atomic finalizeOrder callback.\n\n**Remediation Steps:**\n1. Verify the current installed version of @payloadcms/plugin-ecommerce in your package.json.\n2. Execute your package manager's upgrade command to fetch version 3.90.0 or later (or 4.0.0-canary.34 or later for the 4.x branch).\n3. Generate database migrations locally by executing: npx payload migrate\n4. Deploy and run the generated migration on staging and production database environments.\n5. Review any internal custom billing or Stripe webhooks to verify compatibility with the new API signature.\n\n## References\n\n- [GitHub Security Advisory GHSA-8r29-2mp2-pmrw](https://github.com/payloadcms/payload/security/advisories/GHSA-8r29-2mp2-pmrw)\n- [Official Fix Commit](https://github.com/payloadcms/payload/commit/6c0c4dc9b4ce1ac87b03fbb5dd7356b8559cbc4e)\n- [Payload CMS v3.90.0 Release Notes](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105850) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T21:30:30.000000Z"}, {"uuid": "a9be2367-14a2-4be8-9f3f-3096aa729455", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105852", "type": "seen", "source": "https://gist.github.com/alon710/998c7ae5221e09a204349281b20d659e", "content": "# CVE-2026-105852: CVE-2026-105852: Authorization Bypass and Related-Document Oracle in Payload CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105852\n\n## Summary\nAn authorization bypass vulnerability in Payload CMS enables unauthenticated attackers to query and infer the existence of restricted documents via nested relationship queries on public collections. This cross-document contamination flaw affects both MongoDB and Drizzle SQL database adapters, allowing unauthorized reads of relationship metadata.\n\n## TL;DR\nUnauthenticated attackers can bypass read-access controls on restricted collections via nested query parameters on related public collections, leaking metadata and confirming document existence.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 5.3 (Medium)\n- **EPSS Score**: Not Available\n- **Impact**: Information Disclosure / Related-Document Oracle\n- **Exploit Status**: Proof of Concept (PoC) documented in integration test suite\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Payload CMS (npm package: payload)\n- **payload**: < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0 < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade Payload CMS dependencies to versions 3.90.0 or 4.0.0-canary.34 and above.\n- Identify relationship, upload, or join fields pointing to restricted collections and restrict querying capabilities.\n- Apply strict field-level access control policies on relations to prevent unauthenticated field lookup.\n\n**Remediation Steps:**\n1. Open the package configuration file (package.json) and verify all payload-related packages.\n2. Run 'npm install payload@latest' or equivalent to update dependency mappings.\n3. Audit application schemas for nested relationship queries and implement query validation layers.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/payloadcms/payload/security/advisories/GHSA-7c34-32v3-j575)\n- [Official Fix Commit Patch](https://github.com/payloadcms/payload/commit/94059cf4bc6170ce88453015c0c6551329ae3982)\n- [Payload v3.90.0 Release Notes](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n- [CVE-2026-105852 National Vulnerability Database Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-105852)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105852) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T22:30:31.000000Z"}, {"uuid": "0fc31771-a4b2-4fe0-8f40-c64e1ab5293f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105853", "type": "seen", "source": "https://gist.github.com/alon710/63205d59d63f7a0fa04234012bcf2681", "content": "# CVE-2026-105853: CVE-2026-105853: Sensitive Information Disclosure and Authentication Collection Boundary Bypass in Payload CMS\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105853\n\n## Summary\nCVE-2026-105853 is a high-severity information disclosure vulnerability in Payload CMS that affects authentication-enabled collections. In vulnerable versions, the application fails to properly serialize and sanitize user documents during token refresh and password reset operations. This deficiency leaks hidden and read-restricted fields to unauthorized actors. Additionally, a logical flaw in token refresh validation allows low-privileged users to cross collection boundaries, exposing sensitive configuration details and administrative metadata.\n\n## TL;DR\nPayload CMS fails to sanitize user documents in password reset and token refresh endpoints, allowing low-privileged authenticated users to access hidden or read-restricted fields across collection boundaries.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.1\n- **EPSS Score**: Not yet populated\n- **Impact**: High Confidentiality Exposure\n- **Exploit Status**: poc\n- **KEV Status**: No\n\n## Affected Systems\n\n- Payload CMS installations with multiple authentication-enabled collections\n- Payload CMS installations with custom fields marked as hidden\n- **payload**: >= 3.0.0, < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade Payload CMS dependencies to versions that contain the official security patches.\n- Manually review and sanitize user documents returned by custom authentication handlers.\n- Deploy WAF rules to monitor and block cross-collection token refresh requests.\n\n**Remediation Steps:**\n1. Identify the current version of Payload CMS running in the package.json file.\n2. Upgrade the package to version 3.90.0 or higher for 3.x branches, or version 4.0.0-canary.34 or higher for 4.x branches.\n3. Rebuild and redeploy the application.\n4. Inspect custom authentication strategies and ensure they apply appropriate sanitization wrappers.\n\n## References\n\n- [GitHub Security Advisory GHSA-xgv3-crq2-6f69](https://github.com/payloadcms/payload/security/advisories/GHSA-xgv3-crq2-6f69)\n- [Fix Commit (Token Refresh Collection Boundary)](https://github.com/payloadcms/payload/commit/f5f1283d275c58b30e2faa6be7cdc4d49451ea91)\n- [Payload CMS Release Version 3.90.0](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105853) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T23:30:31.000000Z"}, {"uuid": "6ef5b373-98ac-44ba-893f-92bda687a90f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105851", "type": "seen", "source": "https://gist.github.com/alon710/e04d756121a8845804f834a1f9badce0", "content": "# CVE-2026-105851: CVE-2026-105851: Privilege Escalation via Field Access Control Bypass in Payload CMS Duplication Mechanism\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105851\n\n## Summary\nA critical access control bypass vulnerability (CVE-2026-105851) in Payload CMS allows authenticated users to bypass field-level access controls during document duplication. By duplicating high-privilege documents, such as administrator accounts, standard users can inherit sensitive fields (e.g., role configurations or API keys), leading to privilege escalation.\n\n## TL;DR\nPayload CMS failed to enforce field-level access controls and the disableDuplicate configuration during document duplication, allowing standard users to duplicate administrator profiles and escalate their privileges.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284 / CWE-863\n- **Attack Vector**: Network (Unauthenticated or Low-Privileged Local Network/API Access)\n- **CVSS v4.0**: 9.3 (Critical)\n- **EPSS Score**: Not Available\n- **Impact**: Privilege Escalation / Unauthorized Data Access\n- **Exploit Status**: Conceptual / Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Payload CMS\n- **payload**: >= 3.0.0, < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade Payload CMS to version 3.90.0 or higher (for 3.x installations) or 4.0.0-canary.34 or higher (for 4.x installations).\n- Explicitly set disableDuplicate: true in all authentication-enabled and high-privilege collection configurations.\n- Implement custom beforeChange or beforeValidate hooks to strip sensitive fields during duplication operations programmatically.\n\n**Remediation Steps:**\n1. Analyze the active Payload CMS version in package.json.\n2. Run npm install payload@3.90.0 or npm install payload@4.0.0-canary.34 depending on the track.\n3. Audit all collection configurations and append disableDuplicate: true to users and administrative schemas.\n4. Rebuild the application and deploy the patch to staging and production systems.\n5. Verify that POST requests to /api/users/:id/duplicate return a 400 or 404 response status.\n\n## References\n\n- [GitHub Security Advisory GHSA-vc4h-q48j-5hcx](https://github.com/payloadcms/payload/security/advisories/GHSA-vc4h-q48j-5hcx)\n- [Payload CMS Commit 099ef12e26](https://github.com/payloadcms/payload/commit/099ef12e2682f076aa8e8d0ccb790536b4e1027f)\n- [Payload CMS v3.90.0 Release Notes](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n- [CVE-2026-105851 Record](https://www.cve.org/CVERecord?id=CVE-2026-105851)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105851) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T00:30:30.000000Z"}, {"uuid": "93d740eb-6960-4b2e-9e63-6db5d916a926", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105850", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxbn3cgoui2h", "content": "CVE-2026-105850 - plugin-ecommerce\nIf you use Payload's e\u2011commerce plugin with Stripe and are running a version earlier than 3.90.0 (or a pre\u2011release before 4.0.0\u2011canary.34), the same order\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#pluginecommerce #payloadcms #npm #CVE #infosec", "creation_timestamp": "2026-10-07T09:30:04.008416Z"}, {"uuid": "6942ed8e-d64e-4313-b0a2-9aac64c301e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105857", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxbnn6tjej2q", "content": "CVE-2026-105857 - payload\nThe free Payload CMS content system\u2019s form\u2011builder plugin can be tricked into running code on your server if you are using a version older than 3.90.0 (or a canary version older\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#payload #payloadcms #CVE #infosec", "creation_timestamp": "2026-10-07T09:40:04.173765Z"}, {"uuid": "0880f353-eed9-4b37-9c92-b70234cf0418", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105859", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxbnnaf32i22", "content": "CVE-2026-105859 - payload\nVersions of Payload CMS older than 3.90.0 (and canary builds older than 4.0.0\u2011canary.34) allow a user to send a special request that changes content items even when they should\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#payload #payloadcms #CVE #infosec", "creation_timestamp": "2026-10-07T09:40:05.731001Z"}, {"uuid": "5ca799d3-9cfe-44c6-9d10-508226e27023", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105851", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxgg6smvog27", "content": "CVE-2026-105851 - payload\nVersions of the Payload headless CMS before 3.90.0 (and certain canary builds) let users duplicate a document and unintentionally copy data from fields that should be\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#payload #elliotpayload #npm #CVE #infosec", "creation_timestamp": "2026-10-09T07:10:04.509730Z"}]}