Most recent entries from all

EUVD-2026-213160

2026-10-03T06:48:18.078879+00:00

EUVD-2026-213160

fkie_cve-2023-30843

2026-10-03T06:48:18.078928+00:00

Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.

GHSA-35jj-vqcf-f2jf — Hidden fields can be leaked on readable collections in Payload

2026-10-03T06:48:18.078977+00:00

Affected: npm: payload

### Details

If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force.

Affected versions: < 1.7.0

### Workarounds

If you are unable to update, you can write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.

### Detecting Compromise

Monitor your instance for brute-force style requests against your instance using `where` queries.

gsd-2023-30843

2026-10-03T06:48:18.079027+00:00

gsd-2023-30843