# CVE-2026-63316: SQL Injection in Payload CMS via in/not_in query parameters

> CERT Polska disclosed a SQL injection flaw (CWE-89) in Payload CMS where user input in the `in` and `not_in` query parameters is not properly neutralized, letting an authenticated attacker inject SQL. Versions before 3.90.0 and 4.0.0-canary.0 through 4.0.0-canary.34 are affected; no exploitation, PoC or CVSS score has been published.

- **Published:** 2026-10-13T11:25:29Z
- **Last reviewed:** 2026-10-13T11:25:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3399
- **ID:** TL-2026-3399
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-63316, CVE-2026-105856, CVE-2026-105845

## Description

CVE-2026-63316 is a SQL injection vulnerability (CWE-89) in Payload CMS, a Node.js/TypeScript headless CMS. The CERT Polska advisory (published 2026-10-13) states that improper neutralization of input supplied in the `in` and `not_in` query parameters allows an authenticated attacker to perform SQL injection attacks. The reporter, 0xMesbaha, disclosed it through the CERT Polska Coordinated Vulnerability Disclosure program.

Payload documents `in` and `not_in` as where-clause operators that take a comma-delimited list of values. In REST they are expressed as `where[field][in]=a,b,c` and `where[field][not_in]=a,b,c`. The advisory identifies these operators as the injection point. It does not describe the exploit mechanics, the affected database adapters, or the privileges the authenticated attacker needs beyond being authenticated.

Affected: all Payload versions before 3.90.0, and 4.0.0-canary.0 through 4.0.0-canary.34. Fixed: 3.90.0 and 4.0.0-canary.34. The advisory lists 4.0.0-canary.34 as both affected and fixed; this inconsistency is unresolved in the source, so defenders should move to a canary build later than .34 or to 3.90.0 or later. The upstream v3.90.0 release notes (2026-09-18) say the release contains a set of critical security fixes but intentionally omit exploit details, so the fix for this CVE cannot be matched to a specific change from public sources.

The source provides no CVSS score, no exploitation status, no PoC and no IOCs. The MEDIUM severity is a provisional analyst placeholder, not a source-stated value. Payload has had other SQL injection issues in 2026 (for example CVE-2026-105845, fixed in 3.88.0 and 4.0.0-canary.27, reported with CVSS 9.8 by a third-party aggregator), which indicates the query-building layer is a recurring weak point. That is context only; those are separate CVEs and are not evidence about this one. Defenders should not assume active exploitation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1565.001 Stored Data Manipulation

## Sources

- [CERT Polska: Vulnerability in Payload CMS software (CVE-2026-63316)](https://cert.pl/en/posts/2026/10/CVE-2026-63316/)
- [CVE Record: CVE-2026-63316](https://www.cve.org/CVERecord?id=CVE-2026-63316)
- [CERT Polska Coordinated Vulnerability Disclosure program](https://cert.pl/en/cvd/)
- [Payload CMS v3.90.0 release notes](https://github.com/payloadcms/payload/releases/tag/v3.90.0)
- [Payload CMS documentation: Query operators (in, not_in)](https://payloadcms.com/docs/queries/overview)
- [Payload CMS GitHub security advisories](https://github.com/payloadcms/payload/security/advisories)
- [Vulert: CVE-2026-105856 SQL Injection in @payloadcms/db-sqlite and db-postgres (related, separate CVE)](https://vulert.com/vuln-db/CVE-2026-105856)
- [Vulert: CVE-2026-105845 SQL Injection in Payload (related, separate CVE)](https://vulert.com/vuln-db/CVE-2026-105845)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3399