GHSA-FPWW-C55P-CJV6 Payload: Polymorphic join queries could disclose hidden fields

Impact A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens. You are affected if: - You use an affected Payload version. - Users can query a collection with a polymorphic join to sensitive fields. Patches User...

Authorization Bypass Through User-Controlled Key

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via polymorphic join query validation in validateSearchParams.ts, where hidden or read-restricted fields are no...

NPM: Payload: Polymorphic join queries could disclose hidden fields

NPM: Payload: Polymorphic join queries could disclose hidden fields vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...