Description
A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens.
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34 >= 3.0.0, < 3.90.0** Patched version(s): **4.0.0-canary.34 3.90.0**
References
Could your website be exposed too?
SmartScanner can check your website for Payload: Polymorphic join queries could disclose hidden fields and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Payload: Sort queries could expose protected field information - CVE-2026-105805
- Payload: Token refresh and password reset responses may expose restricted user fields - CVE-2026-105853
- MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables - CVE-2026-63640
- Payload: Client uploads could overwrite S3 objects - CVE-2026-105867
You might also like:
See something that needs correcting? Let us knowUpdated October 06, 2026