Payload CMS SQL Injection Flaw Allows Low-Privilege Authenticated Attacks

Payload CMS has disclosed an SQL injection vulnerability, CVE-2026-63316, caused by improper neutralization of user input in the in and not_in query parameters. An authenticated attacker with low privileges can exploit the flaw over a network without user interaction. The published CVSS v4.0 vector indicates high confidentiality and integrity impacts and low availability impact. CERT Polska coordinated disclosure and credited researcher 0xMesbaha with responsibly reporting the issue; the supplied reports do not establish active exploitation.

Versions before 3.90.0 and a range of 4.0.0 canary builds are identified as vulnerable. The advisories name 3.90.0 and 4.0.0-canary.34 as fixed releases, but CERT Polska’s affected-version listing also includes 4.0.0-canary.34, leaving that build’s status inconsistent. Organizations running affected stable releases should upgrade to 3.90.0 or a later supported release; canary users should verify the corrected version guidance with the maintainer before treating canary.34 as remediated.