---
cve: "CVE-2026-105849"
severity: "HIGH"
cvss: 7.7
epss: ""
vendor: "payloadcms"
kev: false
exploited: false
published: "2026-10-06 17:17:20"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-26T03:33:48+01:00"
---

# CVE-2026-105849

> 7.7 HIGH · 🧪 PoC

## Beschreibung

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-10-06 17:26:23
- CNA-CVSS: **7.7** (`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-201** — Insertion of Sensitive Information Into Sent Data
  The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
- **CWE-862** — Missing Authorization
  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

## Angriffsmuster (CAPEC)

- [CAPEC-12 — Choosing Message Identifier](https://capec.mitre.org/data/definitions/12.html) _(Severity: High)_
- [CAPEC-217 — Exploiting Incorrectly Configured SSL/TLS](https://capec.mitre.org/data/definitions/217.html)
- [CAPEC-612 — WiFi MAC Address Tracking](https://capec.mitre.org/data/definitions/612.html) _(Severity: Low)_
- [CAPEC-613 — WiFi SSID Tracking](https://capec.mitre.org/data/definitions/613.html) _(Severity: Low)_
- [CAPEC-618 — Cellular Broadcast Message Request](https://capec.mitre.org/data/definitions/618.html) _(Severity: Low)_
- [CAPEC-619 — Signal Strength Tracking](https://capec.mitre.org/data/definitions/619.html) _(Severity: Low)_
- [CAPEC-621 — Analysis of Packet Timing and Sizes](https://capec.mitre.org/data/definitions/621.html) _(Severity: Low)_
- [CAPEC-622 — Electromagnetic Side-Channel Attack](https://capec.mitre.org/data/definitions/622.html) _(Severity: Low)_

## Patch verfügbar (OSV)

- e10b60228b92b680663110ea2af431643bfc6126 (Commit)
- 880d2e900be22cd66a9e939f2b3e702fa413180f (Commit)

## Referenzen

- <https://github.com/payloadcms/payload/security/advisories/GHSA-238x-w2j9-gwwr>
- <https://github.com/payloadcms/payload/commit/880d2e900be22cd66a9e939f2b3e702fa413180f>
- <https://github.com/payloadcms/payload/releases/tag/v3.90.0>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-105849/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_