GHSA-35jj-vqcf-f2jf

    Dashboard / Vulnerabilities / GHSA-35jj-vqcf-f2jf

    GHSA-35jj-vqcf-f2jf

    Published: 26 Apr 2023Last Modified: 10 Sept 2026

    Summary: Hidden fields can be leaked on readable collections in Payload

    Details: ### Details If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Affected versions: < 1.7.0 ### Workarounds If you are unable to update, you can write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data. ### Detecting Compromise Monitor your instance for brute-force style requests against your instance using `where` queries.

    References: https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf, https://nvd.nist.gov/vuln/detail/CVE-2023-30843, https://github.com/payloadcms/payload, https://github.com/payloadcms/payload/releases/tag/v1.7.0

    Affected packages

    Package

    Name: payload

    Purl: pkg:npm/payload

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.7.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-35jj-vqcf-f2jf | CVE-DB