Payload: Token refresh and password reset responses may expose restricted user fields
## Impact Token refresh and password reset responses could return fields that the requesting user did not have access to. You are affected if: - An authentication collection contains hidden or read-restricted fields. ## Patches Authentication responses now apply field access and hidden-field filtering before returning user documents. Full user documents remain available server-side for access control. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. Custom authentication strategies remain responsible for filtering user documents returned through custom responses. ## Workarounds There is no complete workaround. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-105853US | medium6.5 | — | ||
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and p… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan