Description
Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read.
You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.27 < 3.88.0** Patched version(s): **4.0.0-canary.27 3.88.0**
References
Could your website be exposed too?
SmartScanner can check your website for Payload: Sort queries could expose protected field information and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Payload: Polymorphic join queries could disclose hidden fields - CVE-2026-105847
- Payload: Uploaded XML files could execute same-origin JavaScript - CVE-2026-105868
- Payload: Client uploads could overwrite S3 objects - CVE-2026-105867
- LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid - CVE-2026-39412
You might also like:
See something that needs correcting? Let us knowUpdated October 06, 2026