Vulnerability Details CVE-2026-105861
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 2.6%
CVSS Severity
CVSS v3 Score 8.2
References
Products affected by CVE-2026-105861
-
cpe:2.3:a:payloadcms:payload:4.0.0