payload@4.0.0-canary.29

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort via generatePasswordSaltHash.ts and the local authentication strategy, which use insufficiently strong password hashing parameters. An attacker with access to the underlying database can recover user passwords more easily than the intended security margin allows due to the weak hashing configuration.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via unbounded multipart request processing in processMultipart.ts. An unauthenticated attacker can send an arbitrarily large multipart request body, causing the server to consume excessive memory or resources and crash.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Improper Authorization via the refreshOperation function in packages/payload/src/auth/operations/refresh.ts, where the collection associated with the authenticated user's token is not validated against the target collection during a token refresh request. An authenticated user belonging to one auth-enabled collection can supply their token to the refresh endpoint of a different auth-enabled collection, potentially obtaining a valid token for that collection and gaining unauthorized read access to its data.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Missing Authorization via document read operations that return the apiKey field without omitting it, allowing an authenticated user with read access to other user documents to retrieve those users' active API keys in plaintext. The fix introduces an omitAPIKey hook and a dedicated revealAPIKey endpoint so that API keys are stripped from standard document reads and only exposed through a privileged endpoint.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Incorrect Authorization via the collection duplication endpoint (/:id/duplicate), where the disableDuplicate collection setting was not enforced at the operation level. An unauthenticated remote attacker can send a POST request to the duplicate endpoint of an auth-enabled collection, bypassing the intended access control restriction and writing duplicate documents to collections that should prohibit duplication. The disableDuplicate flag was only used to suppress the endpoint registration in some code paths, but the underlying createOperation did not independently verify the flag, allowing the restriction to be circumvented.

Note: This is only exploitable against collections where disableDuplicate is set (including auth collections, where it is enabled by default), because those are the collections the access control was intended to protect.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via polymorphic join query validation in validateSearchParams.ts, where hidden or read-restricted fields are not rejected when used as filter conditions in polymorphic join queries. An authenticated user with query access can probe field values - including password-reset tokens - by observing differences in query responses, effectively inferring data they are not authorized to read.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Missing Authorization via the contains query operator on relationship, upload, and join fields, where access control filters injected for a related collection are not scoped to the same document as the user's filter. An unauthenticated remote attacker can craft a nested contains query that causes the access constraint and the user-supplied filter to resolve against different related documents, allowing the attacker to read data from related collections that should be restricted by access control rules.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Missing Authorization via the reorder endpoint in packages/payload/src/config/orderable/index.ts, where access control checks on update operations are insufficient. An unauthenticated or unauthorized attacker can send reorder requests to manipulate the ordering of collection documents without holding the required update permissions, because the endpoint previously only checked access for the first document being moved and did not enforce per-document where-based access constraints across all affected records. The fix introduces assertUpdateAccess, which validates update access for every document involved in a reorder operation and enforces where-clause access results before committing changes.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to External Control of File Name or Path via the deleteAssociatedFiles function in packages/payload/src/uploads/deleteAssociatedFiles.ts, where a filename stored in an upload document is not validated before being resolved into a file path for deletion. An authenticated attacker with upload permissions can supply a path-traversal sequence (e.g. ../../sensitive-file) as the filename, causing the server to delete arbitrary files outside the configured static upload directory.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related file-type detection logic. An authenticated attacker can upload a file with a manipulated MIME type or filename that misrepresents its true content type - for example, delivering XML or SVG content under a non-XML MIME type - causing the server to serve the file without the appropriate Content-Security-Policy restrictions. This allows the attacker to execute scripts in the context of a victim user's browser when the file is subsequently accessed.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Origin Validation Error via getExternalFile in packages/payload/src/uploads/getExternalFile.ts, where the origin of an external file request URL is not validated before fetching. When a relative URL is supplied as the file source, the original code reconstructs the base URL using the attacker-controlled origin request header, allowing an attacker to redirect the server-side fetch to an arbitrary origin and potentially exfiltrate authentication cookies. Additionally, the externalFileHeaderFilter callback previously received a static copy of request headers without context about whether the target is same-origin, meaning auth cookies could be forwarded to external hosts.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via getFieldsToSign in the JWT authentication layer, where user-controlled fields included in the JWT payload can override reserved claims (id, collection, email, sid, exp, iat). An attacker who can register or update a user account with field values that shadow these reserved JWT claims can forge authentication context, potentially gaining access as an arbitrary user or collection.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can upload a file with a manipulated MIME type or filename that causes the server to serve XML-family content (including SVG) without adequate Content-Security-Policy controls or server-side type validation, enabling script execution in the context of a victim's browser when the file is viewed.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.

payload is a Node, React and MongoDB Headless CMS and Application Framework

Affected versions of this package are vulnerable to Overly Restrictive Account Lockout Mechanism via the resetPassword operation, which fails to reset the account lockout state upon a successful password reset. An attacker who triggers repeated failed login attempts to lock an account can keep that account locked even after the legitimate user resets their password, causing a crash of the authentication flow for that user.

Upgrade payload to version 3.90.0, 4.0.0-canary.34 or higher.