CVE-2026-105860

The Payload headless content management system is vulnerable to a tenant authorization bypass in the @payloadcms/plugin-multi-tenant plugin. In versions before 3.90.0 and canary versions before 4.0.0-canary.34 , the default tenant array field access allows an authenticated user to assign their ow...

CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

CVE-2026-105857

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857 Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

CVE-2026-105857

The Payload headless content management system is vulnerable to Remote Code Execution (RCE) via the @payloadcms/plugin-form-builder component. An attacker can exploit this by crafting a malicious form submission to execute code remotely on the server. This issue is linked to CWE-94 (Code Injectio...

CVE-2026-105857 Payload: RCE in Payload Form Builder

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105854 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105854 Source advisory: OSV:GHSA-2G7P-5934-Q4W7...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105854 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105854 Source advisory: SNYK:JS-PAYLOAD-20571510...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105854 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105854 Source advisory: GHSA-2G7P-5934-Q4W7...

GHSA-8R29-2MP2-PMRW Payload Ecommerce has an order confirmation validation issue

Impact When using the Stripe payment adapter, an order confirmation could be processed more than once under certain conditions. You are affected if: - You use @payloadcms/plugin-ecommerce with the Stripe payment adapter. Deployments that do not use the Stripe payment flow are not affected. Patche...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105854 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105854 Source advisory: MEND:CVE-2026-105854...

CVE-2026-105806

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

CVE-2026-105844

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended applicatio...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105853 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105853 Source advisory: MEND:CVE-2026-105853...

CVE-2026-104070 SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

CVE-2026-104070

The Crayons plugin for SPIP versions before 3.5.0 is vulnerable to a missing authorization flaw in crayons_store.php. By omitting the secu_ anti-forgery parameter, unauthenticated attackers can bypass modification checks and modify arbitrary editable object fields. This allows attackers to chain ...

EUVD-2026-93493

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

CVE-2026-105850

The Payload headless content management system is vulnerable in @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34 . When using the Stripe payment adapter , certain conditions can cause a Stripe order confirmation to be processed more than once. This is...

GHSA-R9V2-GG2J-22Q5 Payload: Insufficient Access Control in Stripe REST Proxy

Impact An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy. You are affected if ALL of these are true: - Your application uses @payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy...