Threat reportVulnerabilityTL-2026-3399
CVE-2026-63316: SQL Injection in Payload CMS via in/not_in query parameters
CVE-2026-63316 (TL-2026-3399) is a medium-severity software vulnerability, first published 2026-10-13. It has no confirmed attribution, affects Payload Payload CMS, references 3 CVEs (CVE-2026-63316, CVE-2026-105856, CVE-2026-105845), maps to 4 MITRE ATT&CK techniques (T1078, T1190, T1213), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3399
- Threat ID
- TL-2026-3399
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, news - media, ecommerce, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in CVE-2026-63316
Malware and tooling: payload
How CVE-2026-63316 works
CERT Polska disclosed a SQL injection flaw (CWE-89) in Payload CMS where user input in the `in` and `not_in` query parameters is not properly neutralized, letting an authenticated attacker inject SQL. Versions before 3.90.0 and 4.0.0-canary.0 through 4.0.0-canary.34 are affected; no exploitation, PoC or CVSS score has been published.
CVE-2026-63316 is a SQL injection vulnerability (CWE-89) in Payload CMS, a Node.js/TypeScript headless CMS. The CERT Polska advisory (published 2026-10-13) states that improper neutralization of input supplied in the `in` and `not_in` query parameters allows an authenticated attacker to perform SQL injection attacks. The reporter, 0xMesbaha, disclosed it through the CERT Polska Coordinated Vulnerability Disclosure program.
Payload documents `in` and `not_in` as where-clause operators that take a comma-delimited list of values. In REST they are expressed as `where[field][in]=a,b,c` and `where[field][not_in]=a,b,c`. The advisory identifies these operators as the injection point. It does not describe the exploit mechanics, the affected database adapters, or the privileges the authenticated attacker needs beyond being authenticated.
Affected: all Payload versions before 3.90.0, and 4.0.0-canary.0 through 4.0.0-canary.34. Fixed: 3.90.0 and 4.0.0-canary.34. The advisory lists 4.0.0-canary.34 as both affected and fixed; this inconsistency is unresolved in the source, so defenders should move to a canary build later than .34 or to 3.90.0 or later. The upstream v3.90.0 release notes (2026-09-18) say the release contains a set of critical security fixes but intentionally omit exploit details, so the fix for this CVE cannot be matched to a specific change from public sources.
The source provides no CVSS score, no exploitation status, no PoC and no IOCs. The MEDIUM severity is a provisional analyst placeholder, not a source-stated value. Payload has had other SQL injection issues in 2026 (for example CVE-2026-105845, fixed in 3.88.0 and 4.0.0-canary.27, reported with CVSS 9.8 by a third-party aggregator), which indicates the query-building layer is a recurring weak point. That is context only; those are separate CVEs and are not evidence about this one. Defenders should not assume active exploitation.
MITRE ATT&CK techniques used in TL-2026-3399
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Privilege Escalation
Collection
T1213 Data from Information Repositories
Impact
Affected products and versions in CVE-2026-63316
- Payload — Payload CMS
Vulnerable versions: all versions before 3.90.0; 4.0.0-canary.0 through 4.0.0-canary.34
Fixed in: 3.90.0; 4.0.0-canary.34 (listed by the advisory as both affected and fixed; unresolved)
Remediation for CVE-2026-63316
Patches
- Upgrade Payload to 3.90.0 or later
- For the 4.x canary line, move to a build later than 4.0.0-canary.34 because the advisory lists .34 as both affected and fixed
Immediate actions
- Inventory Payload CMS deployments (npm package `payload`) and identify any running a version before 3.90.0 or 4.0.0-canary.0 through 4.0.0-canary.34
- Review web/API access logs for requests to Payload REST and GraphQL endpoints with SQL metacharacters in where[...][in] or where[...][not_in] values
- Review which accounts hold authenticated access to Payload APIs and remove unused or untrusted accounts
Workarounds
- No vendor workaround is stated in the advisory; restrict API access to trusted authenticated users until patched
Longer-term hardening
- Place a WAF with SQL injection rules in front of Payload API routes
- Run the application database user with least privilege so injected queries have limited reach
- Track Payload GitHub security advisories and release notes, since upstream releases have bundled several security fixes
CVEs associated with CVE-2026-63316
Weaknesses (CWE) in CVE-2026-63316
Timeline of CVE-2026-63316
- Separate Payload SQL injection CVE-2026-105845 published, fixed in 3.88.0 and 4.0.0-canary.27 (context only; not this CVE)
- Separate Payload SQL injection CVE-2026-105856 (GHSA-pj7x-6wpf-pgvp, CVSS 8.6) disclosed for db-sqlite/db-postgres adapters via json/blocksAsJSON field paths; SQLite adapters fixed in 3.90.0 and 4.0.0-canary.34 (context only; not stated to be this CVE)
- Payload v3.90.0 released with a set of security fixes whose details are intentionally omitted from the release notes; the advisory lists 3.90.0 as fixed for CVE-2026-63316
- Threadlinqs opens tracking; no exploitation, PoC or IOCs are reported, and NVD returned no data for the CVE at time of research
- CVE-2026-63316 record published; no CVSS score is stated in the CERT Polska advisory
- CERT Polska publishes the advisory for CVE-2026-63316, crediting 0xMesbaha
Sources cited for CVE-2026-63316
- CERT Polska: Vulnerability in Payload CMS software (CVE-2026-63316)
- CVE Record: CVE-2026-63316
- CERT Polska Coordinated Vulnerability Disclosure program
- Payload CMS v3.90.0 release notes
- Payload CMS documentation: Query operators (in, not_in)
- Payload CMS GitHub security advisories
- Vulert: CVE-2026-105856 SQL Injection in @payloadcms/db-sqlite and db-postgres (related, separate CVE)
- Vulert: CVE-2026-105845 SQL Injection in Payload (related, separate CVE)
Detection coverage for TL-2026-3399
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3399 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.