{"id":"EUVD-2026-93489","enisaUuid":"90b920a7-793f-3ff8-a2ad-c2517f238f08","description":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:02:55 PM","dateUpdated":"Oct 6, 2026, 5:22:16 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-fpww-c55p-cjv6\nhttps://github.com/payloadcms/payload/commit/caa3f69b5aecc6e7c2b459ed87972cbca9f33ee5\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105847\nGHSA-fpww-c55p-cjv6\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"0fbfe52f-e3dd-3dba-9ba2-0c0aba79257f","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"fb459731-0f10-33c6-8ed0-7569cc934e4f","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"enisaIdVendor":[{"id":"f935d951-69f5-38f0-8a85-fe1002ce61ce","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"b3bdcd7d-1db0-3c38-9002-b29e04ee8216","vulnerability":{"id":"CVE-2026-105847","description":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:02:55 PM","dateUpdated":"Oct 6, 2026, 5:22:16 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-fpww-c55p-cjv6\nhttps://github.com/payloadcms/payload/commit/caa3f69b5aecc6e7c2b459ed87972cbca9f33ee5\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93489\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Nov 2, 2026, 7:16:47 AM","vulnerabilityProduct":[{"id":"be180565-bd68-3f16-9208-28830a71fb19","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"c312bd09-733a-3107-b4b2-95870f8e593d","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"vulnerabilityVendor":[{"id":"9c31e98a-2cab-3419-9cd8-a23d08b44e4f","vendor":{"name":"payloadcms"}}]}},{"id":"e4ee46f9-7ca6-3dfe-a381-96eeac1ff811","vulnerability":{"id":"GHSA-fpww-c55p-cjv6","description":"Payload: Polymorphic join queries could disclose hidden fields","datePublished":"Oct 6, 2026, 4:09:04 PM","dateUpdated":"Oct 6, 2026, 4:09:04 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-fpww-c55p-cjv6\nhttps://github.com/payloadcms/payload/commit/caa3f69b5aecc6e7c2b459ed87972cbca9f33ee5\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93489\n","aliases":"GHSA-fpww-c55p-cjv6\nCVE-2026-105847\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}