{"action":"Upgrade payload to 3.88.0 or later.","affected":[{"fixed":"3.88.0","introduced":"0"},{"fixed":"4.0.0-canary.27","introduced":"4.0.0-canary.0"}],"component":"payload","cve_ids":["CVE-2026-105805"],"ecosystem":"npm","epss":0.00276,"exploited":false,"fixed_versions":["3.88.0","4.0.0-canary.27"],"ghsa_id":"GHSA-9g87-32v6-3c2r","id":"tcs_01M5KFFRTG4G82BR9NWC87PT4C","modified_at":"2026-10-06T15:46:47.481931142Z","published_at":"2026-10-06T15:38:32Z","references":["https://osv.dev/vulnerability/GHSA-9g87-32v6-3c2r","https://github.com/payloadcms/payload/security/advisories/GHSA-9g87-32v6-3c2r","https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a","https://github.com/payloadcms/payload","https://github.com/payloadcms/payload/releases/tag/v3.88.0"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"GHSA-9g87-32v6-3c2r","url":"https://osv.dev/vulnerability/GHSA-9g87-32v6-3c2r"},{"source":"nvd","source_id":"CVE-2026-105805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105805"}],"summary":"Payload: Sort queries could expose protected field information"}