CVE-2026-105853: Payload: Token refresh and password reset responses may expose restricted user fields

October 6, 2026

Token refresh and password reset responses could return fields that the requesting user did not have access to.

You are affected if:

An authentication collection contains hidden or read-restricted fields.

References

github.com/advisories/GHSA-xgv3-crq2-6f69
github.com/payloadcms/payload/commit/f5f1283d275c58b30e2faa6be7cdc4d49451ea91
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-xgv3-crq2-6f69
nvd.nist.gov/vuln/detail/CVE-2026-105853

Code Behaviors & Features

Detect and mitigate CVE-2026-105853 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →