What is GHSA-xgv3-crq2-6f69?

GHSA-xgv3-crq2-6f69 is a security advisory published by GitHub Security Advisories with High severity. Payload: Token refresh and password reset responses may expose restricted user fields

Which CVE IDs does GHSA-xgv3-crq2-6f69 cover?

GHSA-xgv3-crq2-6f69 covers the following CVE IDs: CVE-2026-105853. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-xgv3-crq2-6f69?

GHSA-xgv3-crq2-6f69 affects 2 products, including: npm/payload:\u003e= 3.0.0, \u003c 3.90.0; npm/payload:\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.34.

GHSA-xgv3-crq2-6f69High

Payload: Token refresh and password reset responses may expose restricted user fields

Vendor

GitHub Security Advisories

Published

October 6, 2026

Last Modified

October 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-105853 →

📋 Description

Impact

Token refresh and password reset responses could return fields that the requesting user did not have access to.

You are affected if:

An authentication collection contains hidden or read-restricted fields.

Patches

Authentication responses now apply field access and hidden-field filtering before returning user documents. Full user documents remain available server-side for access control.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Custom authentication strategies remain responsible for filtering user documents returned through custom responses.

Workarounds

There is no complete workaround. Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

🎯 Affected products2

npm/payload:>= 3.0.0, < 3.90.0
npm/payload:>= 4.0.0-canary.0, < 4.0.0-canary.34