payload
v3.93.0Payload is the open-source, fullstack Next.js framework, giving you instant backend superpowers. Get a full TypeScript backend and admin panel instantly. Use Payload as a headless CMS or for building powerful applications.
- Maintenance
- Active609 commits in 3 months · bus factor 3
- License
- MITPermissive · OSI-approved
- Security
- 30 advisories2 critical, 14 high, 14 medium · Scorecard 4.5/10
- Supported versions
- No scheduleendoflife.date does not track this project
45.8k stars · 4.4k forks · 1.6k open issues · last release 10 days ago · data checked 53 minutes ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 2 critical, 14 high, 14 medium. Check the patched version against the one you run.
- mediumGHSA-wc63-5fg7-7r49Nov 9, 2026Server-side request forgery via remote URL uploads
- Affected
- >= 3.18.0, < 3.93.0; >= 4.0.0-canary.0, < 4.0.0-beta.7
- Patched in
- >= 3.93.0; >= 4.0.0-beta.7
- highGHSA-j4q6-g29w-5cmgNov 9, 2026Queries on blocks fields could expose read-restricted field information
- Affected
- >= 3.0.0, < 3.93.0; >= 4.0.0-canary.0, < 4.0.0-beta.7
- Patched in
- >= 3.93.0; >= 4.0.0-beta.7
- highGHSA-23qg-v79q-g836Nov 9, 2026Uploaded XSL files could bypass XML response protection in S3 storage
- Affected
- < 3.93.0; >= 4.0.0-canary.0, < 4.0.0-beta.7
- Patched in
- >= 3.93.0; >= 4.0.0-beta.7
- mediumGHSA-fq8v-j6fp-3rrxNov 9, 2026Uncontrolled resource consumption in Open Graph image endpoint
- Affected
- >= 3.0.0, < 3.93.0; >= 4.0.0-canary.0, < 4.0.0-beta.7
- Patched in
- >= 3.93.0; >= 4.0.0-beta.7
- highGHSA-9wh8-6gp5-gx53Nov 9, 2026Stored XSS in @payloadcms/richtext-lexical
- Affected
- >= 3.0.0-beta.74, < 3.93.0; >= 4.0.0-beta.0, < 4.0.0-beta.7
- Patched in
- >= 3.93.0; >= 4.0.0-beta.7
- mediumGHSA-mg7r-jhr9-m745Oct 8, 2026Improper privilege management in scheduled publishing
- Affected
- >= 3.12.0, < 3.89.0; >= 4.0.0-canary.0, < 4.0.0-canary.29
- Patched in
- >= 3.89.0; >= 4.0.0-canary.29
- mediumGHSA-wvw7-x9pg-w4ccOct 8, 2026Insufficient session expiration after password changes
- Affected
- >= 3.44.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
- Patched in
- >= 3.90.0; >= 4.0.0-canary.34
- mediumGHSA-g6p9-6gm4-cj6mOct 8, 2026Authorization bypass of client uploads
- Affected
- >= 3.25.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
- Patched in
- >= 3.90.0; >= 4.0.0-canary.34
- mediumGHSA-m35c-r5p5-c3w8Oct 8, 2026Improper Restriction of Excessive Authentication Attempts
- Affected
- >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
- Patched in
- >= 3.90.0; >= 4.0.0-canary.34
- mediumGHSA-97w9-jq7h-73pqOct 8, 2026Improper Neutralization of Formula Elements in a CSV File in plugin-import-export
- Affected
- >= 3.27.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
- Patched in
- >= 3.90.0; >= 4.0.0-canary.34
- mediumGHSA-8j2x-hjh9-3ff8Oct 8, 2026Incorrect authorization for framework collections
- Affected
- >= 3.0.0, < 3.90.0
- Patched in
- >= 3.90.0
- highGHSA-cqr4-hjg9-833pOct 8, 2026Improper authentication in MCP when using custom authentication
- Affected
- >= 3.64.0, < 3.88.0
- Patched in
- >= 3.88.0
- highGHSA-h5rh-4jwf-738pOct 6, 2026Account takeover through MCP password recovery
- Affected
- >= 3.61.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.31
- Patched in
- >= 3.90.0; >= 4.0.0-canary.31
- highGHSA-jjm7-864w-gg8qOct 6, 2026Hidden-field leak in MCP login responses
- Affected
- >= 3.61.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.31
- Patched in
- >= 3.88.0; >= 4.0.0-canary.31
- highGHSA-2qw6-cm49-277xOct 6, 2026Access bypass of Payload Jobs
- Affected
- >= 3.0.0, < 3.89.0; >= 4.0.0-canary.0, < 4.0.0-canary.29
- Patched in
- >= 3.89.0; >= 4.0.0-canary.29
- mediumCVE-2026-105804Sep 29, 2026Password hashes use insufficient PBKDF2 iterations
- Affected
- >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
- Patched in
- >= 3.90.0; >= 4.0.0-canary.34
- mediumCVE-2026-93363Sep 25, 2026Access control bypass of uploads in Vercel Storage adapter
- Affected
- >= 3.25.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
- Patched in
- >= 3.90.0; >= 4.0.0-canary.34
- mediumCVE-2026-105805Sep 22, 2026Sort queries could expose protected field information
- Affected
- < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27
- Patched in
- >= 3.88.0; >= 4.0.0-canary.27
- highCVE-2026-105806Sep 22, 2026Improper access control for MCP API keys
- Affected
- >= 3.61.0, < 3.88.0
- Patched in
- >= 3.88.0
- criticalCVE-2026-105844Sep 22, 2026Prototype pollution in Payload Import Export plugin
- Affected
- >= 3.0.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27
- Patched in
- >= 3.88.0; >= 4.0.0-canary.27
- criticalCVE-2026-105845Sep 22, 2026SQL Injection in SQLite and Postgres
- Affected
- >= 3.0.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27
- Patched in
- >= 3.88.0; >= 4.0.0-canary.27
- mediumCVE-2026-105846Sep 22, 2026Untrusted redirect URL parameter exploit
- Affected
- >= 3.40.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27; >= 3.31.0, < 3.88.0
- Patched in
- >= 3.88.0; >= 4.0.0-canary.27
- highCVE-2026-105847Sep 18, 2026Polymorphic join queries could disclose hidden fields
- Affected
- >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
- Patched in
- 3.90.0; 4.0.0-canary.34
- mediumCVE-2026-105848Sep 18, 2026Insufficient Access Control in Stripe REST Proxy
- Affected
- < 3.90.0; < 4.0.0-canary.34
- Patched in
- 3.90.0; 4.0.0-canary.34
- highCVE-2026-105849Sep 18, 2026API key disclosure through ordinary document reads
- Affected
- >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
- Patched in
- 3.90.0; 4.0.0-canary.34
- highCVE-2026-105850Sep 18, 2026Order confirmation validation issue in Payload Ecommerce
- Affected
- < 3.90.0, < 4.0.0-canary.34
- Patched in
- 3.90.0, 4.0.0-canary.34
- mediumCVE-2026-105852Sep 18, 2026Payload relationship-query authorization bypass
- Affected
- < 3.90.0, < 4.0.0-canary.34
- Patched in
- 3.90.0, 4.0.0-canary.34
- highCVE-2026-105853Sep 18, 2026Token refresh and password reset responses may expose restricted user fields
- Affected
- >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
- Patched in
- 3.90.0; 4.0.0-canary.34
- highCVE-2026-105854Sep 18, 2026ReDoS in Multipart Content-Type Validation
- Affected
- >= 3.0.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34
- Patched in
- 3.90.0; 4.0.0-canary.34
- highCVE-2026-105855Sep 18, 2026Field-level password update restrictions were not enforced
- Affected
- < 3.90.0; < 4.0.0-canary.34
- Patched in
- 3.90.0; 4.0.0-canary.34