CVE-2026-105849: Payload vulnerable to API key disclosure through ordinary document reads

October 6, 2026

Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled.

You are affected if:

An authentication collection enables useAPIKey.
Users have read access to other user documents containing active API keys.

References

github.com/advisories/GHSA-238x-w2j9-gwwr
github.com/payloadcms/payload/commit/880d2e900be22cd66a9e939f2b3e702fa413180f
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-238x-w2j9-gwwr
nvd.nist.gov/vuln/detail/CVE-2026-105849

Code Behaviors & Features

Detect and mitigate CVE-2026-105849 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →