CVE-2026-105858High· 8.1▾ TwilightPayload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local aut…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
payload < 3.90.0payload >= 4.0.0-canary.0, < 4.0.0-canary.34Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105857Critical· 10.0Payload: RCE in Payload Form Builder
CVE-2026-105856High· 8.6Payload: SQL injection in SQLite/Postgres
CVE-2026-105859Critical· 9.8Payload: Unauthorized update to collection documents
CVE-2026-105861High· 7.2Payload external upload trust validation issue
CVE-2026-105860High· 7.1Payload: Tenant authorization bypass in Multi-Tenant Plugin
CVE-2026-105863Critical· 9.2Payload authentication token field handling issue