CVE-2026-105852: Payload relationship-query authorization bypass

October 6, 2026

A readable collection could expose information about protected documents in a related collection.

You are affected if:

You expose a readable collection with a relationship to a collection protected by access.read where constraints.

References

github.com/advisories/GHSA-7c34-32v3-j575
github.com/payloadcms/payload/commit/94059cf4bc6170ce88453015c0c6551329ae3982
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-7c34-32v3-j575
nvd.nist.gov/vuln/detail/CVE-2026-105852

Code Behaviors & Features

Detect and mitigate CVE-2026-105852 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →