{"id":"EUVD-2026-93497","enisaUuid":"95792029-4898-34cd-b229-a2449eedf81d","description":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:16:14 PM","dateUpdated":"Oct 9, 2026, 1:12:54 AM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-xgv3-crq2-6f69\nhttps://github.com/payloadcms/payload/commit/f5f1283d275c58b30e2faa6be7cdc4d49451ea91\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105853\nGHSA-xgv3-crq2-6f69\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"0487b8d3-5e99-3fcd-a1c1-8975810e8ab1","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"d1dfa905-7559-3deb-ba03-bc5a967e84bf","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"}],"enisaIdVendor":[{"id":"c670d81a-95ea-3fd2-a239-fcea01879280","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"6b0c2142-4af6-317c-a79f-068cb6f0161e","vulnerability":{"id":"GHSA-xgv3-crq2-6f69","description":"Payload: Token refresh and password reset responses may expose restricted user fields","datePublished":"Oct 6, 2026, 4:17:28 PM","dateUpdated":"Oct 6, 2026, 4:17:28 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-xgv3-crq2-6f69\nhttps://github.com/payloadcms/payload/commit/f5f1283d275c58b30e2faa6be7cdc4d49451ea91\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93497\n","aliases":"CVE-2026-105853\nGHSA-xgv3-crq2-6f69\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b0ddd127-f712-336a-88eb-429c1e6c0f52","vulnerability":{"id":"CVE-2026-105853","description":"Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:16:14 PM","dateUpdated":"Oct 9, 2026, 1:12:54 AM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-xgv3-crq2-6f69\nhttps://github.com/payloadcms/payload/commit/f5f1283d275c58b30e2faa6be7cdc4d49451ea91\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93497\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 6, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"52c398f2-3d2c-3275-a936-a3a1fa0c4596","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"ab09f287-6e4c-3911-893f-1046cb383cd2","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"vulnerabilityVendor":[{"id":"0399474d-c1a3-3a66-be74-5f7c729a0556","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}