CVE Vulnerability Catalog

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in.

In Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed.

In Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This leads to code execution in the victim's browser.

In Payload CMS versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.

The @payloadcms/plugin-multi-tenant plugin before versions 3.90.0 and canary before 4.0.0-canary.34 by default allows an authenticated user to assign their own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and update functions are not affected. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions before 3.90.0 and canary before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions before 3.90.0 and 4.0.0-canary.34, an attacker with read and create/update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through crafted field paths and operators. Collections without those fields and richText fields are not affected. SQLite packages fixed in 3.90.0 and 4.0.0-canary.34, Postgres fixed in 3.73.0.

In Payload versions before 3.90.0 and canary before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. Fixed in versions 3.90.0 and 4.0.0-canary.34.

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints.

Payload CMS in versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability in the duplicate operation that copies values from a source document even when a field is hidden or its access.read/access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. Fixed in versions 3.90.0 and 4.0.0-canary.34.

MCP TypeScript SDK versions from 1.12.0 before 1.31.0 and 2.2.0 let the MCP server a client connects to decide which authorization server receives the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server in its protected resource metadata. Without user interaction, the client would send that server the `refresh_token` and `client_secret` stored from an earlier sign-in (1.x), or the configured `client_secret` or signed assertion of a bundled non-interactive provider (1.x and 2.x). Only applications using the SDK as an MCP client over HTTP with an `authProvider`: your own `OAuthClientProvider`, or the bundled `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` or (2.x) `CrossAppAccessProvider` and that may connect to an MCP server the owners do not fully trust while holding credentials for a legitimate authorization server are affected. `@modelcontextprotocol/sdk` 1.31.0 (1.x) and `@modelcontextprotocol/client` 2.2.0 (2.x) patch the issue. A workaround is available. 2.0.0 and 2.1.0 already accept `expectedIssuer`. On 1.x, the only workaround is to connect OAuth-enabled clients only to trusted MCP servers.

Dell Container Storage Modules versions prior to 1.18.0 contain a Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could exploit it, leading to information tampering.

Dell Container Storage Modules (CSM) versions prior to 1.18.0 contain a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could create unauthorized tenant entities, inject cross-tenant roles, and modify storage access control flags.

Dell Container Storage Modules (CSM) versions prior to 1.18.0 contain an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could exploit it, leading to exposure of storage backend administrator credentials.

Dell Container Storage Modules versions prior to 1.18.0 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could exploit it, leading to information disclosure.

External Secrets Operator versions from 0.10.0 to 1.3.1 contain a bug in the webhook generator initialization order that clears the EnforceLabels flag after it is set. This skips the label check for external-secrets.io/type=webhook, allowing an operation that should fail. Version 1.3.2 contains a patch.

Payload CMS in @payloadcms/plugin-mcp versions from 3.61.0 to 3.88.0 allows an authenticated user to manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This is fixed in version 3.88.0.