Is payload affected by CVE-2026-105852?

npm payload is affected in = 4.0.0-canary.0 < 4.0.0-canary.34.

Is CVE-2026-105852 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

Payload relationship-query authorization bypass

A readable collection could expose information about protected documents in a related collection.

You are affected if:

You expose a readable collection with a relationship to a collection protected by access.read where constraints.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

There is no complete workaround. Upgrade Payload packages >= 3.90.0 or >= 4.0.0-canary.34.