- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 35
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://payloadcms.com
Products and areas 11
- Authentication end to end: the auth-enabled collection, JWT issuance and verification, refresh, logout, password reset, email verification and API keys
- Drafts, versions and scheduled publishing, which hold unpublished content behind an access rule
- Hooks and the lifecycle they run in, where a hook observes or mutates a document with more authority than the request that triggered it
- The access-control functions themselves: the per-collection and per-field read, create, update and delete rules, and the query constraints they return
- The admin panel and the Next.js routes it mounts into the host application, along with the components that render user-supplied field data
- The database adapters and the query layer, covering how a where clause supplied by a request becomes a database query
- The Local API, which runs in-process inside the host Next.js application and can bypass HTTP-layer assumptions entirely
- The plugin interface and the first-party plugins built on it
- The published policy is three lines naming a security address and the GitHub advisory flow. It declares no scope boundary at all, so the whole of the Payload codebase and the @payloadcms/* packages are the target
- The REST API and the GraphQL API, both generated from a project's collections and both gated by the same access functions
- Upload-enabled collections, image resizing and the storage adapters that put files somewhere the app serves them from
Out of scope (6)
- Access-control functions an application developer wrote incorrectly in their own project, rather than a defect in how Payload evaluates them
- Deployment configuration, including a secret committed to a repository or an admin panel exposed without a network boundary
- Figma's own properties, which belong to Figma's paid HackerOne program and are not this codebase
- The policy publishes no exclusions of its own, so nothing else is carved out by name. What follows are genuine out-of-scope classes
- Third-party community plugins and storage adapters that are not part of the Payload monorepo
- Upstream Next.js, Node and database dependencies, unless Payload's own use of them is what makes the issue reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report to the address on the policy page or through GitHub private vulnerability reporting on payloadcms/payload .
-
Name the Payload version, the Next.js version and the database adapter
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-106100 | Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4. | High 7.1 | 6 Oct 2026 |
| CVE-2026-105863 | Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0. | Critical 9.2 | 6 Oct 2026 |
| CVE-2026-105864 | Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed. This issue | Medium 5.3 | 6 Oct 2026 |
| CVE-2026-105865 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to truste | High 8.1 | 6 Oct 2026 |
| CVE-2026-105866 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | Medium 6.9 | 6 Oct 2026 |
| CVE-2026-105867 | Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the targ | High 7.1 | 6 Oct 2026 |
| CVE-2026-105868 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | High 8.6 | 6 Oct 2026 |
| CVE-2026-105856 | Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operators. Collections without those fields are not affected, and richText fields are not affected. The SQLite | High 8.6 | 6 Oct 2026 |
| CVE-2026-105857 | Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | Critical 10.0 | 6 Oct 2026 |
| CVE-2026-105858 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | High 8.1 | 6 Oct 2026 |
| CVE-2026-105859 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0 | Critical 9.8 | 6 Oct 2026 |
| CVE-2026-105860 | Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and tenants arrayFi | High 7.1 | 6 Oct 2026 |
| CVE-2026-105861 | Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0. | High 7.2 | 6 Oct 2026 |
| CVE-2026-105862 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | High 8.7 | 6 Oct 2026 |
| CVE-2026-105850 | Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | High 8.8 | 6 Oct 2026 |
| CVE-2026-105851 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue | Critical 9.3 | 6 Oct 2026 |
| CVE-2026-105852 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where constraints. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | Medium 6.9 | 6 Oct 2026 |
| CVE-2026-105853 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | High 7.1 | 6 Oct 2026 |
| CVE-2026-105854 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | High 8.7 | 6 Oct 2026 |
| CVE-2026-105855 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | High 7.6 | 6 Oct 2026 |
| CVE-2026-105846 | Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27. | Medium 6.1 | 6 Oct 2026 |
| CVE-2026-105847 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | High 7.1 | 6 Oct 2026 |
| CVE-2026-105848 | Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. | Medium 6.4 | 6 Oct 2026 |
| CVE-2026-105849 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versio | High 7.7 | 6 Oct 2026 |
| CVE-2026-34746 | Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. This issue has been patched in version 3.79.1. | High 7.7 | 1 Apr 2026 |
| CVE-2026-34747 | Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1. | High 8.5 | 1 Apr 2026 |
| CVE-2026-34748 | Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0. | High 8.7 | 1 Apr 2026 |
| CVE-2026-34749 | Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1. | Medium 5.4 | 1 Apr 2026 |
| CVE-2026-34750 | Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. This issue has been p | Medium 6.5 | 1 Apr 2026 |
| CVE-2026-34751 | Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload. | Critical 9.1 | 1 Apr 2026 |
| CVE-2026-27567 | Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. The Payload environment must have at lea | Medium 6.5 | 24 Feb 2026 |
| CVE-2026-25544 | Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixe | Critical 9.8 | 6 Feb 2026 |
| CVE-2026-25574 | Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belon | Medium 5.4 | 6 Feb 2026 |
| CVE-2023-30843 | Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field | High 7.4 | 26 Apr 2023 |
| CVE-2022-27952 | An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file. | Critical 9.8 | 12 Apr 2022 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 9 Last 12 months 10 Lifetime Access control 40 % Auth bypass 25 % Info disclosure 20 % Injection 15 % Latest advisories Loading the feed Overview Payload is a TypeScript headless CMS that installs into a Next.js application rather than sitting beside it, so its access-control layer runs in the same process as the app it protects. Around 2.17 million npm installs a month. Figma acquired it in 2025 and runs a paid HackerOne program, and Payload appears nowhere in that program's scope: the word does not occur anywhere in the program's JSON or policy, and the policy was last changed in December 2025, after the acquisition, without adding it. Nine of Payload's ten lifetime advisories landed in the last twelve months, two of them critical. sorona.xyz pays you directly on qualified, reproduced findings. In scope The published policy is three lines naming a security address and the GitHub advisory flow. It declares no scope boundary at all, so the whole of the Payload codebase and the @payloadcms/* packages are the target The access-control functions themselves: the per-collection and per-field read, create, update and delete rules, and the query constraints they return The REST API and the GraphQL API, both generated from a project's collections and both gated by the same access functions The Local API, which runs in-process inside the host Next.js application and can bypass HTTP-layer assumptions entirely Authentication end to end: the auth-enabled collection, JWT issuance and verification, refresh, logout, password reset, email verification and API keys The admin panel and the Next.js routes it mounts into the host application, along with the components that render user-supplied field data Upload-enabled collections, image resizing and the storage adapters that put files somewhere the app serves them from Hooks and the lifecycle they run in, where a hook observes or mutates a document with more authority than the request that triggered it The database adapters and the query layer, covering how a where clause supplied by a request becomes a database query Drafts, versions and scheduled publishing, which hold unpublished content behind an access rule The plugin interface and the first-party plugins built on it Out of scope Figma's own properties, which belong to Figma's paid HackerOne program and are not this codebase The policy publishes no exclusions of its own, so nothing else is carved out by name. What follows are genuine out-of-scope classes Access-control functions an application developer wrote incorrectly in their own project, rather than a defect in how Payload evaluates them Upstream Next.js, Node and database dependencies, unless Payload's own use of them is what makes the issue reachable Third-party community plugins and storage adapters that are not part of the Payload monorepo Deployment configuration, including a secret committed to a repository or an admin panel exposed without a network boundary Most-valued findings Access-control evaluation defects: a request reaching a document, a field or an operation the collection's access functions were supposed to deny. Nine advisories landed in the window and this is the layer the entire product is Anything that produces an authenticated session without credentials, or that escalates between users on an auth-enabled collection. Two criticals landed in the window Field-level access leaking through the GraphQL schema or through a populated relationship, where a field denied on a direct read comes back via another route JWT and API key handling, covering issuance, verification, expiry and any token that reaches a collection it was not scoped for Password reset and email verification flows, which mint authority from an unauthenticated request Query construction from where clauses and populate parameters, where request input reaches the database adapter Upload handling and the storage adapter interface, where a file lands somewhere the host application serves or executes it Draft and version endpoints returning unpublished content to a request that should only see published documents Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report to [email protected] or through GitHub private vulnerability reporting on payloadcms/payload . Every published advisory went through the GitHub flow The SECURITY.md is three lines long. There is no scope statement, no exclusions list, no reward language and no response SLA to hold anyone to payloadcms.com/security is a marketing page about security features rather than a reporting channel, and the domain publishes no security.txt Figma's paid HackerOne program does not cover Payload. Its eight in-scope assets are all Figma's own properties and its stated focus is unauthorized access to Figma user data Name the Payload version, the Next.js version and the database adapter, since the CMS runs inside the host application and the adapter changes the query surface No payment exists on either side of the acquisition, so there is nothing to negotiate Disclosure Coordinated through the GitHub advisory flow and published as a GHSA on payloadcms/payload alongside a patched release. Publication is batched, with six of the ten lifetime advisories landing together on 30 March 2026, so plan for an embargo that runs to the next release rather than to a published day count. Nothing about timing is written down, so agree a date in the advisory thread. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability