CVE-2026-105847

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.33

Description A user capable of querying a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, such as password-reset tokens, by utilizing polymorphic join filters. A polymorphic join is a database query technique that allows a field to relate to multiple different collection types.

Recommendations Update Payload versions 3.0.0 through 3.89.9 to version 3.90.0 or later. Update Payload versions 4.0.0-canary.0 through 4.0.0-canary.33 to version 4.0.0-canary.34 or later. Restrict read access to sensitive collections to reduce exposure.