# Payload CMS patches authenticated SQL injection flaw

Published: 2026-10-13 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/6c14d65f-c426-504a-88da-4ba92cf75cdc/payload-cms-patches-authenticated-sql-injection-flaw

> CERT Polska coordinated disclosure of CVE-2026-63316, a SQL injection in Payload CMS query parameters, fixed in versions 3.90.0 and 4.0.0-canary.34.

CERT Polska disclosed CVE-2026-63316, a SQL injection vulnerability in Payload CMS, a headless content management system. The flaw stems from improper neutralization of user-supplied input in the 'in' and 'not_in' query parameters, which allows an authenticated attacker to inject and execute arbitrary SQL commands against the backend database. Exploitation requires the attacker to already hold valid credentials on the target instance, limiting the blast radius to insiders or accounts compromised through other means, but successful exploitation could expose, modify, or exfiltrate database contents depending on the privileges of the application's database user.

The vulnerability was reported through CERT Polska's coordinated vulnerability disclosure process, credited to researcher 0xMesbaha, and has been fixed by the Payload CMS maintainers in version 3.90.0 of the stable branch and 4.0.0-canary.34 of the canary branch. There is no indication in this advisory of active exploitation in the wild. Defenders running Payload CMS should prioritize upgrading to a patched version, review authenticated user accounts and their database privileges, and audit query logs for anomalous use of 'in'/'not_in' filter parameters as a precaution.

## Mentioned in this report

- Vulnerabilities: CVE-2026-63316

## Detection guidance (public sample)

### Payload CMS Query In/Not_In Parameter With SQL Injection Syntax

ATT&CK: T1190

Detects web requests where the Payload CMS 'in' or 'not_in' where-filter parameter carries UNION or boolean-style SQL injection syntax (CVE-2026-63316). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Payload CMS Query In/Not_In Parameter With SQL Injection Syntax
id: 90f91acd-acf9-50a0-85b0-4358f842acc1
status: experimental
description: Detects HTTP requests whose query string uses the Payload CMS where[field][in]
  or where[field][not_in] filter together with UNION or boolean-based SQL injection
  syntax. Relates to CVE-2026-63316, which needs authenticated access. The pattern
  is generic and not tied to a specific collection or field name.
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-63316
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains:
    - '[in]'
    - '[not_in]'
    - '%5Bin%5D'
    - '%5Bnot_in%5D'
  selection_sqli:
    cs-uri-query|contains:
    - union select
    - union all select
    - union%20select
    - union%20all%20select
    - union+select
    - union+all+select
    - or 1=1
    - or%201=1
    - or+1=1
    - ''' or '''
    - '''%20or%20'''
    - '%27%20or%20%27'
    - '''--'
    - '%27--'
    - '''/*'
  condition: selection_param and selection_sqli
falsepositives:
- Authorised penetration tests or vulnerability scans against the CMS
- Content searches that legitimately contain SQL keywords inside an in-filter value
level: medium
author: Vorant
```

### Payload CMS Query In/Not_In Parameter With Time-Based or Schema-Enumeration SQL Functions

ATT&CK: T1190

Detects Payload CMS where[field][in]/[not_in] filters containing SQL sleep functions, schema enumeration or stacked queries, indicating blind SQL injection (CVE-2026-63316). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Payload CMS Query In/Not_In Parameter With Time-Based or Schema-Enumeration
  SQL Functions
id: f4772f6c-e164-5ece-adc9-8c129d744313
status: experimental
description: Detects HTTP requests that use the Payload CMS where[field][in] or where[field][not_in]
  filter together with SQL time-delay functions, error-based extraction functions,
  system catalog references or stacked queries. These indicate blind or error-based
  exploitation of an authenticated SQL injection flaw (CVE-2026-63316).
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-63316
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains:
    - '[in]'
    - '[not_in]'
    - '%5Bin%5D'
    - '%5Bnot_in%5D'
  selection_sqli:
    cs-uri-query|contains:
    - pg_sleep
    - sleep(
    - sleep%28
    - waitfor delay
    - waitfor%20delay
    - benchmark(
    - benchmark%28
    - extractvalue(
    - updatexml(
    - information_schema
    - pg_catalog
    - sqlite_master
    - ;select
    - '%3bselect'
    - ;drop
    - '%3bdrop'
  condition: selection_param and selection_sqli
falsepositives:
- Authorised penetration tests or vulnerability scans against the CMS
- Documentation or knowledge-base content queries that legitimately reference terms
  such as information_schema
level: high
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-63316

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6c14d65f-c426-504a-88da-4ba92cf75cdc/payload-cms-patches-authenticated-sql-injection-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup