CVE-2026-105861 is a High severity information exposure in Payload, the headless CMS. After 3.0.0 and before 3.90.0, authenticated external URL based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, which can expose a valid session. Upgrade to 3.90.0.
What's affected
- Package: payload (npm).
- Affected: after 3.0.0 and before 3.90.0, and canary builds before 4.0.0-canary.34 per the advisory.
- Fixed: 3.90.0. The advisory also names a canary fix, but spells it inconsistently, so confirm the exact canary build there.
- Condition: external URL based upload retrieval is enabled and authenticated requests can trigger it.
- Workarounds from the advisory: disable external URL retrieval where practical, configure the upload header filter to remove authentication data from outbound requests, and restrict access to the upload feature.
The record scores this 8.2 (CVSS 3.1 vector) and calls it High. The project's GitHub advisory gives a score of 7.2 and a rating of High under CVSS v4. Both are listed here because different scoring systems rate the same flaw differently. Judge urgency by whether the described configuration matches yours. The record lists only 3.90.0 as the fix, while the advisory also names a canary fix.
How to check if you're exposed
Payload is an npm package, so read the installed version in each project and environment.
npm ls payload
pnpm why payload
grep -n "payload" package.json
Check every deployment target too: production, staging, preview builds and any container image built from an older commit. Then look at the packages next to Payload, because this release series also touches plugins and database adapters:
npm ls @payloadcms/plugin-ecommerce @payloadcms/plugin-multi-tenant
npm ls @payloadcms/db-postgres @payloadcms/db-sqlite @payloadcms/db-vercel-postgres @payloadcms/db-d1-sqlite
Then check whether you fetch uploads from remote URLs.
grep -rn "upload" src/collections/
List every upload collection, then check the Payload documentation for your version to see which settings enable retrieval of files from an external URL. If your upload collections only accept direct file uploads, the condition in the advisory does not apply.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.
What to do now
- Upgrade all Payload packages together to 3.90.0 or later on the 3.x line, or to 4.0.0-canary.34 or later on the canary line, and keep versions in step across packages.
- Find upload collections that allow retrieval from an external URL, and decide whether you need the feature.
- If you can, turn the feature off until the upgrade is done.
- If you must keep it, configure the upload header filter to strip authentication data from outbound file requests.
- Invalidate sessions for users who used URL based uploads before the upgrade if you have any doubt about exposure.
- Read the v3.90.0 release notes for behavior and API changes that may need code updates, and run your test suite before deploying.
- Redeploy every environment, including preview and staging, and rebuild container images.
- Re-scan your lockfile after the change to confirm no older copy of the package remains.
Why it matters
The record lists CWE-200, exposure of sensitive information to an unauthorized actor, and CWE-346, origin validation error. The mechanism in the advisory is a familiar one: a server makes an outgoing request on behalf of a user and includes the user's credentials, but the request is redirected to a destination nobody checked.
The credentials then end up with whoever runs that destination. If the request contained a valid session, the advisory says the session could be exposed to an unintended recipient. A session in the wrong hands is account access.
The patched version validates the destination before forwarding authentication data, and applies the check again when a request changes destination, per the advisory. The record does not list this CVE as exploited in the wild. Payload's release notes for v3.90.0 describe a set of critical security fixes and recommend upgrading even if none of the listed items affect you. They also say exploit details and severity are intentionally left out of the notes, so read each advisory for the conditions.
Quick check
What is the safest workaround?
The advisory lists disabling external URL based upload retrieval where practical, then filtering authentication data from outbound requests if you cannot.
What would be exposed?
A valid session, according to the advisory, if the affected request carried one.
Sources
Last reviewed: 18 October 2026.
