Repository navigation
fix(deps): update dependency payload to v3.90.0 [security] - #153
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.88.0→3.90.0Payload: Password hashes use insufficient PBKDF2 iterations
CVE-2026-105804 / GHSA-q6mq-ch85-c8mm
More information
Details
Impact
The password-hashing configuration used a lower work factor than what is recommended.
Patches
Payload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login.
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Workarounds
Upgrading is recommended. Until you can upgrade, protect database copies and backups from unauthorized access and require strong, unique passwords.
Severity
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload: Polymorphic join queries could disclose hidden fields
CVE-2026-105847 / GHSA-fpww-c55p-cjv6
More information
Details
Impact
A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens.
You are affected if:
Patches
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Workarounds
There is no complete workaround. Restricting read access to sensitive collections reduces exposure but does not replace upgrading.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload vulnerable to API key disclosure through ordinary document reads
CVE-2026-105849 / GHSA-238x-w2j9-gwwr
More information
Details
Impact
Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled.
You are affected if:
useAPIKey.Patches
Users should upgrade payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Workarounds
Disable
useAPIKeyor restrict users to reading only their own authentication document. Rotate any API key that may have been exposed.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload: Field access control bypass on auth collections
CVE-2026-105851 / GHSA-vc4h-q48j-5hcx
More information
Details
Impact
Payload's duplicate operation copies field values from the source document even when a field is hidden, or its
access.readoraccess.createrule would reject the value for that caller.The
disableDuplicatecollection setting, enabled by default on auth collections, did not stop this.Patches
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Workarounds
Add a beforeDuplicate field hook to fields and set the value to empty or your default value.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload: Token refresh and password reset responses may expose restricted user fields
CVE-2026-105853 / GHSA-xgv3-crq2-6f69
More information
Details
Impact
Token refresh and password reset responses could return fields that the requesting user did not have access to.
You are affected if:
Patches
Authentication responses now apply field access and hidden-field filtering before returning user documents. Full user documents remain available server-side for access control.
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Custom authentication strategies remain responsible for filtering user documents returned through custom responses.
Workarounds
There is no complete workaround. Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload: ReDoS in Multipart Content-Type Validation
CVE-2026-105854 / GHSA-2g7p-5934-q4w7
More information
Details
Impact
A malformed multipart request body could take an extremely long time to finish.
Patches
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload relationship-query authorization bypass
CVE-2026-105852 / GHSA-7c34-32v3-j575
More information
Details
Impact
A readable collection could expose information about protected documents in a related collection.
You are affected if:
Patches
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Workarounds
There is no complete workaround. Upgrade Payload packages
>= 3.90.0or>= 4.0.0-canary.34.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload didn't enforce field-level password update restrictions
CVE-2026-105855 / GHSA-fx49-4h83-wjv9
More information
Details
Impact
When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly.
Patches
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload authentication token field handling issue
CVE-2026-105863 / GHSA-66wr-7vmr-p5jq
More information
Details
Impact
Under certain field configurations, Payload could include unintended values in the authentication token issued at login.
You are affected if:
Patches
Payload now restricts which field configuration options can influence the contents of the authentication token.
Users should upgrade payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Workarounds
There is no complete workaround. Users should upgrade payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload external upload trust validation issue
CVE-2026-105861 / GHSA-pj5h-5q6c-3pfx
More information
Details
Impact
Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient.
You are affected if:
Patches
Payload now validates the destination before forwarding authentication data and reapplies that validation when a request changes destination.
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Workarounds
It is recommended to update all Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.If you cannot, a valid workaround exists:
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload: Unauthorized update to collection documents
CVE-2026-105859 / GHSA-f7hx-52q9-hcrf
More information
Details
Impact
An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control.
You are affected if:
orderable: truewith any collection or join field.Patches
In the patched version access control is properly enforced.
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload: Unauthenticated account-lockout denial of service
CVE-2026-105866 / GHSA-v5gf-vpjc-pc7w
More information
Details
Impact
An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in.
You are affected if:
Applications that do not use Payload local authentication are not affected.
Patches
Successful password resets now clear the account’s lockout state. The forgot-password flow also enforces a configurable minimum interval between reset emails, which defaults to 15 seconds.
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload: Uploaded XML files could execute same-origin JavaScript
CVE-2026-105868 / GHSA-9qpg-3cf8-w33x
More information
Details
Impact
Under certain local upload configurations, an uploaded XML file and stylesheet could execute JavaScript in the Payload origin when a logged-in user opens the file.
You are affected if:
Patches
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Workarounds
Disallow XML/XSL uploads.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload: Bypassed sanitization of user uploaded SVGs
CVE-2026-105862 / GHSA-2pwp-2369-8fg3
More information
Details
Impact
A malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript (XSS) after a user downloads it and opens it.
You are affected if:
Patches
The fix validates SVG content on every upload path and hardens SVG/XML delivery so stored SVGs cannot frame attacker content.
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Workarounds
Disallow SVG uploads, or serve uploaded SVGs as downloads with Content-Disposition: attachment and a strict CSP. These mitigations reduce exposure but do not replace upgrading when the patched release is available.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload: Remote Code Execution through first-register
CVE-2026-105858 / GHSA-97rh-rhh2-7vjv
More information
Details
Impact
A crafted request to the public first-register operation can be used to perform a RCE exploit.
You are affected if:
Patches
In the patched version data submission to create first user is properly sanitized.
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Payload: Incomplete validation during the upload file lifecycle
CVE-2026-105865 / GHSA-p223-2wr2-j562
More information
Details
Impact
Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption.
You are affected if:
Deployments that restrict upload management to trusted users are less exposed.
Patches
Payload now validates uploaded filenames and ensures file cleanup remains within the configured upload directory.
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34.Workarounds
Restrict upload update and deletion operations to trusted users and validate submitted filenames. These measures are temporary mitigations. Upgrading to a patched version is recommended.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
payloadcms/payload (payload)
v3.90.0Compare Source
These notes only cover the behavior, configuration, and API-surface changes that projects may need to react to when upgrading. Exploit details, attack surface descriptions, and severity are intentionally omitted.
CVE and GHSA identifiers for the underlying issues are published separately.
How to read this document
Every entry has: Affected if you (concrete conditions - if none apply, no action is required), and Action required.
After upgrading:
pnpm payload generate:typesPassword changes now revoke other sessions
Password reset now clears lockouts; forgot-password is throttled
Adds new
resetPasswordRequestedAtfield to user collectionsAction required:
pnpm payload generate:typesScheduled publishing preserves the scheduling user's auth collection
Affected if you:
schedulePublishjobs directly or depend on its generated task types.Action required:
user: { relationTo, value }(value is user ID).Stricter validation for SVG and XML uploads
Affected if you:
Action required:
allowRestrictedFileTypes: truein the collectionsuploadproperty if the previous behavior is explicitly required.Client uploads hardened across all adapters
Affected if you:
clientUploads: true(S3, GCS, Azure, or custom).Action required:
x-goog-if-generation-matchheader to GCS CORS allowed headers.Azure containers default to private
Affected if you:
@payloadcms/storage-azureadapter withallowContainerCreate: trueAction required:
containerAccess: 'blob'in your Azure storage config.Client uploads are stored in a per-upload folder
Affected if you:
clientUploadswith a storage adapter and access stored files outside Payload (for example, by building paths fromprefixandfilename)prefixvalues outside the adapter's collectionprefixWhat changed:
<prefix>/<_objectKey>/<filename>, including generated image sizes._objectKeyis a new field on upload collections. Existing files are not moved.user-123with collection prefixmediais stored undermedia/user-123/.Action required:
_objectKey(when set) between the prefix and filename when building storage paths outside Payload._objectKeycolumn.disablePayloadAccessControlno longer disables safe outbound fetchAffected if you:
disableAccessControl: truein your Payload config.Action required:
upload.skipSafeFetchallowlist for trusted destinationsskipSafeFetch: trueonly when every URL accepted by the collection is trusted.External file fetches require a trusted origin
Affected if you:
upload.disableLocalStorage: trueand rely on Payload fetching relative URLs whose endpoint requires a Payload session cookie.externalFileHeaderFilter, particularly if it assumes it runs only once.Action required:
serverURLor add the exact application origin to your CORS or CSRF configuration.externalFileHeaderFilterand use the optional context when headers need to vary by destination.upload: { externalFileHeaderFilter: (headers, context) => { + if (!context?.isSameOrigin) { + delete headers.cookie + delete headers.authorization + } + return headers }, }Uploaded filename hardening
Affected if you:
Action required:
Multipart uploads are now capped at 50MB by default
Affected if you:
Action required:
requestSizeLimitin your Payload config:upload { + requestSizeLimit: 75 * 1024 * 1024, // Example 75 MiB for the complete multipart request }Form Builder defaults form submission read access to the admin collection
Affected if you:
Action required:
Stricter
wherevalidation for polymorphic joinsPolymorphic joins now apply complete
whereconstraints and throw aQueryErrorwhen a filter is unsupported.Unsupported filters include:
owner.email.near,within,intersects, andalloperators.Affected if you:
collectionreferences multiple collections, andwhereconstraint.baseFilterorbaseListFilterused by folder browsing.Action required:
whereconstraints and read access rules for every collection referenced by a polymorphic join.API keys are no longer readable after initial generation through UI or within Payload operations
If you wish to retain old behavior, set the following in your config:
auth: { - useAPIKey: true, + useAPIKey: { + reveal: true, + }, }Lexical version bump
Full Details
No application changes or data migration are needed when using Payload's built-in rich text features.
If you maintain custom rich text features, check that they still compile and that custom content loads, copies, and pastes correctly. Lexical removed some older APIs, tightened TypeScript types, and changed how custom nodes are loaded and copied. Tests that inspect the editor's HTML may also need updated selectors or snapshots because Lexical adds some internal markup.
Do not install lexical or @lexical/* yourself for use with Payload. Remove any direct dependencies you added for the editor and use Payload's re-exports from
@payloadcms/richtext-lexical/lexicaland@payloadcms/richtext-lexical/lexical/*. Payload supplies the matching versions; mixing versions can break the editor. This is the existing custom feature requirement.v3.89.0Compare Source
🚀 Features
🐛 Bug Fixes
🛠 Refactors
📚 Documentation
improve access defaults for jobs (#17867) (4379bf0)
This backports the v4 jobs access changes to Payload v3.
🤝 Contributors
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.