{"id":"EUVD-2026-93464","enisaUuid":"84676f3e-fe1e-32c5-82cf-d9d8a21b91c2","description":"Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.","datePublished":"Oct 6, 2026, 3:25:29 PM","dateUpdated":"Oct 6, 2026, 4:25:35 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-9g87-32v6-3c2r\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","aliases":"CVE-2026-105805\nGHSA-9g87-32v6-3c2r\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"2025cf59-afcf-3b8e-8da8-e371b8fff94e","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"},{"id":"2bdb418b-c300-345d-840b-408884385bab","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.88.0"}],"enisaIdVendor":[{"id":"762a913c-f4a3-355e-b817-896cf1c6744b","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"85671fdf-897b-3c0a-978f-520f7b1508ac","vulnerability":{"id":"CVE-2026-105805","description":"Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.","datePublished":"Oct 6, 2026, 3:25:29 PM","dateUpdated":"Oct 6, 2026, 4:25:35 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-9g87-32v6-3c2r\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","enisa_id":"EUVD-2026-93464\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Nov 2, 2026, 7:16:47 AM","vulnerabilityProduct":[{"id":"107d5e43-b10c-32b2-ad65-d9aa409adda1","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.88.0"},{"id":"accac38e-d3ac-375f-800b-7e08dcf86b68","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"}],"vulnerabilityVendor":[{"id":"b81d6d6b-6592-3d29-925d-e20f082ffbcb","vendor":{"name":"payloadcms"}}]}},{"id":"f886ab99-266b-30a7-a3fd-6c5480a65a07","vulnerability":{"id":"GHSA-9g87-32v6-3c2r","description":"Payload: Sort queries could expose protected field information","datePublished":"Oct 6, 2026, 3:38:32 PM","dateUpdated":"Oct 6, 2026, 3:38:32 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-9g87-32v6-3c2r\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","enisa_id":"EUVD-2026-93464\n","aliases":"GHSA-9g87-32v6-3c2r\nCVE-2026-105805\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}