Description
A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks.

This issue was fixed in version 3.90.0 and 4.0.0-canary.34.
Published: 2026-10-13
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Potential data compromise through unauthorized database access
Action: Immediate patch
AI Analysis

Impact

Payload CMS is vulnerable to SQL injection via the "in" and "not_in" query parameters. User‑supplied input is not properly neutralized, enabling an authenticated attacker to inject arbitrary SQL into database queries. This flaw can lead to unauthorized data disclosure, modification, or denial of service against the underlying database.

Affected Systems

All releases of Payload CMS prior to 3.90.0 and 4.0.0-canary.34 are affected. The issue applies to the web application code that processes request parameters "in" and "not_in" in its query parsing layer.

Risk and Exploitability

The CVSS score of 8.7 marks this vulnerability as high severity. The flaw requires valid credentials, so an authenticated attacker can exploit it; however the EPSS score is not available, meaning the exploitation frequency is unknown. The vulnerability is not listed in CISA KEV at this time.

Generated by OpenCVE AI on October 13, 2026 at 12:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Payload CMS to version 3.90.0 or later, including 4.0.0-canary.34, where the vulnerability has been remediated.
  • Implement strict input validation or sanitization for the "in" and "not_in" query parameters to prevent future injection attacks.
  • Restrict database user permissions to the minimum required for application operations, limiting the impact of any potential SQL execution.

Generated by OpenCVE AI on October 13, 2026 at 12:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34.
Title SQL Injection in Payload CMS
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-10-13T12:36:21.079Z

Reserved: 2026-07-16T12:42:37.683Z

Link: CVE-2026-63316

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T12:17:14.473

Modified: 2026-10-13T12:17:14.473

Link: CVE-2026-63316

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T12:30:07Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')