Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file. You are affected if: You accept XML uploads (accepted by default).
An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control. You are affected if: You are configuring orderable: true with any collection or join field.
Impact An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in. You are affected if: Using an affected Payload version with an auth-enabled collection that uses local authentication and account lockout. Applications that do not use Payload local authentication are not affected. Patches Successful password resets now clear the account’s lockout state. The forgot-password flow also …
A crafted request to the public first-register operation can be used to perform a RCE exploit. You are affected if: You use local auth strategy and your application remains without an initial user created
Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption. You are affected if: You use Payload upload collections with local file storage. Untrusted authenticated users can update or delete uploads. Deployments that restrict upload management to trusted users are less exposed.
A malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript (XSS) after a user downloads it and opens it. You are affected if: You have a collection configured to upload and allow SVG files which can then be downloaded by users.
Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient. You are affected if: You have enabled external URL-based upload retrieval, where authenticated requests can trigger it.
Under certain field configurations, Payload could include unintended values in the authentication token issued at login. You are affected if: You use an affected Payload version and have configured a custom field option that maps a field to a reserved authentication claim name.
Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating.
Token refresh and password reset responses could return fields that the requesting user did not have access to. You are affected if: An authentication collection contains hidden or read-restricted fields.
A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: You use an affected Payload version. Untrusted users can query readable collections using dynamic filters or joins. You are not affected if you use MongoDB (@payloadcms/mongodb).
Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read. You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.
A malformed multipart request body could take an extremely long time to finish.
A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens. You are affected if: You use an affected Payload version. Users can query a collection with a polymorphic join to sensitive fields.
The password-hashing configuration used a lower work factor than what is recommended.
Payload's duplicate operation copies field values from the source document even when a field is hidden, or its access.read or access.create rule would reject the value for that caller. The disableDuplicate collection setting, enabled by default on auth collections, did not stop this.
Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: An authentication collection enables useAPIKey. Users have read access to other user documents containing active API keys.
A readable collection could expose information about protected documents in a related collection. You are affected if: You expose a readable collection with a relationship to a collection protected by access.read where constraints.
When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly.
An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.
A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. Users are affected if: They are using Payload version < v3.79.1 with any auth-enabled collection using the built-in forgot-password functionality.
An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. Consumers are affected if ALL of these are true: Payload version < v3.79.1 At least one collection with upload enabled An authenticated user has create or update access to that collection
Certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.
A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. Consumers are affected if ALL of these are true: Payload version < v3.79.1 serverURL is configured
A Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. Users are affected if ALL of these are true: Payload version < v3.75.0 At least one collection with upload enabled A user has create access to that upload-enabled collection An authenticated user with upload collection …
A cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. Users are affected if ALL of these are true: Multiple auth collections configured (e.g., admins + customers) Postgres or SQLite database …
A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user. This …
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). This issue has been fixed in version 3.44.0 of Payload.
Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a beforeOperation hook to remove where queries that attempt to access hidden field data.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.