{"id":"EUVD-2026-93495","enisaUuid":"9b78766b-72ea-31be-b727-5ca2b384d02e","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:15:03 PM","dateUpdated":"Oct 6, 2026, 5:22:49 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-7c34-32v3-j575\nhttps://github.com/payloadcms/payload/commit/94059cf4bc6170ce88453015c0c6551329ae3982\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105852\nGHSA-7c34-32v3-j575\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"8bb3baf7-f938-3a38-90cb-f3d55eec059e","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"b8021528-adff-30a8-acc7-4e59b611c8ee","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"enisaIdVendor":[{"id":"9d4c45ab-4c94-3599-a313-80bef3c9382f","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"b5344714-d388-38dd-b929-d4f6047b4369","vulnerability":{"id":"GHSA-7c34-32v3-j575","description":"Payload relationship-query authorization bypass","datePublished":"Oct 6, 2026, 4:17:32 PM","dateUpdated":"Oct 6, 2026, 4:17:33 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-7c34-32v3-j575\nhttps://github.com/payloadcms/payload/commit/94059cf4bc6170ce88453015c0c6551329ae3982\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93495\n","aliases":"GHSA-7c34-32v3-j575\nCVE-2026-105852\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fd233487-4c5d-34ed-ab6e-79257913136d","vulnerability":{"id":"CVE-2026-105852","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:15:03 PM","dateUpdated":"Oct 6, 2026, 5:22:49 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-7c34-32v3-j575\nhttps://github.com/payloadcms/payload/commit/94059cf4bc6170ce88453015c0c6551329ae3982\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93495\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Nov 4, 2026, 7:15:38 AM","vulnerabilityProduct":[{"id":"c236e945-1379-3f71-bf46-6116b3e90e74","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"d5ae7f25-5572-3486-862e-b5dc417fd618","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"vulnerabilityVendor":[{"id":"f602abeb-671e-345a-a815-92536470d517","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}