Loading vulnerability…
Authenticated SQL Injection in Payload CMS Query Parameters
CVE-2026-63316 is an authenticated SQL injection vulnerability in Payload CMS caused by improper neutralization of user-supplied input in the "in" and "not_in" query parameters. An attacker with low-privileged authenticated access can submit crafted queries over the network to manipulate database operations without user interaction. Affected releases include versions before 3.90.0 and vulnerable 4.0.0 canary builds. Versions 3.90.0 and 4.0.0-canary.34 are identified as fixed, although the affected-version listing inconsistently also includes 4.0.0-canary.34.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise database confidentiality and integrity through unauthorized data access or modification, subject to database permissions and query context. The reported CVSS v4.0 assessment indicates high confidentiality and integrity impacts and low availability impact to the vulnerable system, with no indicated impact to subsequent systems. Specific exploitable database operations are not documented.
If you can’t patch tonight, do this now.
No confirmed workaround is documented. Pending upgrade, restrict affected query functionality to trusted users and, where feasible, temporarily disable queries using the "in" and "not_in" parameters. These measures reduce exposure but are not confirmed fixes.
Patch, then assume compromise.
Upgrade Payload CMS to version 3.90.0 or a later patched stable release. For the 4.0.0 canary branch, version 4.0.0-canary.34 is identified as the fix; however, because the affected-version listing also includes that release, verify its patch status with the maintainer before relying on it.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.