CVE-2026-25544: Payload CMS: SQL Injection via JSON and richText Fields
Payload CMS versions before 3.73.0 are vulnerable to SQL injection when querying JSON or richText fields, which allows blind SQL injection without authentication. The CVSS 3.1 base score is 9.8, and the description reports possible exposure of emails, password reset tokens and full account takeover. Upgrading to 3.73.0 or later is the documented fix.
Overview
Payload is a headless CMS. According to the GitHub Security Advisory, user input used when querying JSON or richText fields was embedded into SQL without escaping. The record classifies this as CWE-89 SQL Injection.
Impact
The record states that an unauthenticated attacker could extract sensitive data such as emails and password reset tokens, and could achieve full account takeover without password cracking. The CVSS 3.1 base score is 9.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, as provided by the CNA.
Affected products and versions
- Payloadcms Payload: the record lists versions less than 3.73.0 as affected.
- The description states that the issue is fixed in 3.73.0.
- The record's fixes list is empty, so the fixed version is taken from the description text.
Exploitation status
The CISA KEV entry is not listed in the record. No confirmed active exploitation appears in the sources consulted. This does not prove that exploitation has not occurred.
Remediation and mitigation
- Upgrade Payload to version 3.73.0 or later.
- Review the vendor advisory for any additional guidance.
- Until the upgrade is complete, restrict unauthenticated access to content endpoints where feasible, and limit exposure of queries against JSON and richText fields.
- If there is evidence of exposure, reset credentials and invalidate outstanding password reset tokens.
Detection guidance
- Review application and database logs for unusual query patterns against content endpoints that filter JSON or richText fields.
- Monitor for unexpected password reset requests and account changes.
- Alert on unusual volumes of unauthenticated requests to content APIs.
Limitations of the available information
The record does not describe the exact affected endpoints, code paths or request conditions. It does not state whether a public exploit exists. The EPSS entry shows a probability of 0.00962 and a percentile of 0.60625, dated 2026-10-13. Any fix details beyond the description are unknown.
Frequently asked questions
Which Payload versions are affected by CVE-2026-25544?
The record lists Payload versions less than 3.73.0 as affected. The description states that the issue is fixed in 3.73.0.
Is this vulnerability being actively exploited?
CISA KEV does not list this CVE in the record, and no confirmed active exploitation appears in the sources consulted. This does not rule out exploitation.
What is the recommended action?
Upgrade Payload to version 3.73.0 or later, review the vendor advisory, and restrict unauthenticated access to content endpoints until the upgrade is complete.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.