Vulnerability GHSA-7c34-32v3-j575

Medium Risk

1 hour ago

Payload relationship-query authorization bypass

0.1.137 - 3.89.0 and 4.0.0-canary.0 - 4.0.0-canary.33

Summary

Payload relationship-query authorization bypass

Details

Impact

A readable collection could expose information about protected documents in a related collection.

You are affected if:

You expose a readable collection with a relationship to a collection protected by access.read where constraints.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

There is no complete workaround. Upgrade Payload packages >= 3.90.0 or >= 4.0.0-canary.34.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

High Risk

1 hour ago

Payload didn't enforce field-level password update restrictions

0.1.137 - 3.89.0 and 4.0.0-canary.0 - 4.0.0-canary.33 GHSA-fx49-4h83-wjv9

High Risk

1 hour ago

Payload: ReDoS in Multipart Content-Type Validation

3.0.0 - 3.89.0 and 4.0.0-canary.0 - 4.0.0-canary.33 GHSA-2g7p-5934-q4w7

High Risk

1 hour ago

Payload vulnerable to API key disclosure through ordinary document reads

3.0.0 - 3.89.0 and 4.0.0-canary.0 - 4.0.0-canary.33 GHSA-238x-w2j9-gwwr

High Risk

1 hour ago

Payload: Token refresh and password reset responses may expose restricted user fields

3.0.0 - 3.89.0 and 4.0.0-canary.0 - 4.0.0-canary.33 GHSA-xgv3-crq2-6f69

Critical

2 hours ago

Payload: SQL Injection in SQLite and Postgres

3.0.0 - 3.87.1 and 4.0.0-canary.0 - 4.0.0-canary.26 GHSA-v49j-62m6-pgrr

View all vulnerabilities for these packages

Impacted packages

payload

Timeline

Published

1 hour ago

Fixed (3.90.0)

Unknown

Fixed (4.0.0-canary.34)

Unknown

Last Modified

1 hour ago