CVE-2026-105863

9.4 Critique

Publiée le 06/10/2026 à 19:17 · Modifiée le 15/10/2026 à 02:09 · Analysée par le NVD · Source : security-advisories@github.com

Description

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.

Traduire en français

Produits concernés

payloadcms payload

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.2 Critique	security-advisories@github.com	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	9.4 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L`

Faiblesses (CWE)

Références

https://github.com/payloadcms/payload/commit/56cd5cd050a57daebf33159e41e5ff9d4a45239c Patch
https://github.com/payloadcms/payload/releases/tag/v3.90.0 PatchRelease Notes
https://github.com/payloadcms/payload/security/advisories/GHSA-66wr-7vmr-p5jq Vendor Advisory

CVE-2026-105863

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs