{"id":"EUVD-2026-93507","enisaUuid":"88bbe6aa-85cb-334d-acdc-dbf7640b751b","description":"Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.","datePublished":"Oct 6, 2026, 4:34:41 PM","dateUpdated":"Oct 6, 2026, 5:39:16 PM","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj5h-5q6c-3pfx\nhttps://github.com/payloadcms/payload/commit/ba5cf6ae20d27a2c15106cb37466419031f86e6d\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105861\nGHSA-pj5h-5q6c-3pfx\n","assigner":"GitHub_M","epss":0.13,"enisaIdProduct":[{"id":"96567a23-780f-3e5b-8986-e18924070f22","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003e 3.0.0, \u003c 3.90.0"},{"id":"cb3a9a08-5d75-3336-b8bd-c21898abf454","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003e 4.0.0-canary.0, \u003c 4.0.0-canary-34"}],"enisaIdVendor":[{"id":"437c2f91-4281-368f-b792-a8c0b5c841de","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"345c9acd-c80a-3059-9f33-7def3b4daf83","vulnerability":{"id":"CVE-2026-105861","description":"Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.","datePublished":"Oct 6, 2026, 4:34:41 PM","dateUpdated":"Oct 6, 2026, 5:39:16 PM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj5h-5q6c-3pfx\nhttps://github.com/payloadcms/payload/commit/ba5cf6ae20d27a2c15106cb37466419031f86e6d\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93507\n","assigner":"GitHub_M","epss":0.13,"dataProcessed":"Nov 1, 2026, 4:04:15 AM","vulnerabilityProduct":[{"id":"7177c1ee-2cd4-3e08-825b-cfc8366cefca","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003e 3.0.0, \u003c 3.90.0"},{"id":"f7a13850-c01c-326c-8d97-36984a6b52c1","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003e 4.0.0-canary.0, \u003c 4.0.0-canary-34"}],"vulnerabilityVendor":[{"id":"b3a3a23f-514a-34e1-a1d4-63e6a9ea3086","vendor":{"name":"payloadcms"}}]}},{"id":"b90dd86b-091c-37ef-9deb-bacd7dba12aa","vulnerability":{"id":"GHSA-pj5h-5q6c-3pfx","description":"Payload external upload trust validation issue","datePublished":"Oct 7, 2026, 8:29:41 PM","dateUpdated":"Oct 7, 2026, 8:29:41 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj5h-5q6c-3pfx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105861\nhttps://github.com/payloadcms/payload/commit/ba5cf6ae20d27a2c15106cb37466419031f86e6d\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93507\n","aliases":"CVE-2026-105861\nGHSA-pj5h-5q6c-3pfx\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}