CVE-2026-105856: payload >= 3.0.0, < 3.90.0, >= 4.0.0-canary.0, < 4.0.0-canary.34; +4 more affected products

Affected technology

payload · >= 3.0.0, < 3.90.0, >= 4.0.0-canary.0, < 4.0.0-canary.34
payloadcms

db-d1-sqlite · >= 3.0.0, < 3.90.0, >= 4.0.0-canary.0, < 4.0.0-canary.34
@payloadcms

db-postgres · >= 3.0.0 < 3.73.0
@payloadcms

db-sqlite · >= 3.0.0, < 3.90.0, >= 4.0.0-canary.0, < 4.0.0-canary.34
@payloadcms

db-vercel-postgres · >= 3.0.0 < 3.73.0
@payloadcms

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.