Summary
Payload CMS can expose active API keys from authentication documents to users who have ordinary read access to other documents in a collection with useAPIKey enabled. An attacker may use the disclosed keys to act with the permissions of affected accounts until those keys are rotated or disabled.
Payload CMS can expose active API keys from authentication documents to users who have ordinary read access to other documents in a collection with useAPIKey enabled. An attacker may use the disclosed keys to act with the permissions of affected accounts until those keys are rotated or disabled.
Affected context
The issue affects Payload CMS collections that use API-key authentication and permit users with ordinary read access to view other authentication documents. It is relevant when active credentials are returned through document access controls or response serialization without sufficient protection. The exposure may allow access beyond the permissions intended for the reader, depending on the affected account roles and API authorization model.
The issue affects Payload CMS collections that use API-key authentication and permit users with ordinary read access to view other authentication documents. It is relevant when active credentials are returned through document access controls or response serialization without sufficient protection. The exposure may allow access beyond the permissions intended for the reader, depending on the affected account roles and API authorization model.
Exploit preconditions
- Attack surface: Payload CMS API endpoints exposing authentication-related documents
- Required access: Ordinary read access to other authentication documents in a collection
- Configuration condition: The collection has
useAPIKeyenabled - Trigger point: Reading authentication documents that contain active API keys
- Why exploitation is possible: Sensitive credentials are disclosed to a reader whose authorization does not require access to those credentials, allowing the keys to be used until they are rotated or disabled
- Attack surface: Payload CMS API endpoints exposing authentication-related documents
- Required access: Ordinary read access to other authentication documents in a collection
- Configuration condition: The collection has
useAPIKeyenabled - Trigger point: Reading authentication documents that contain active API keys
- Why exploitation is possible: Sensitive credentials are disclosed to a reader whose authorization does not require access to those credentials, allowing the keys to be used until they are rotated or disabled
Why this happens
The underlying issue is insufficient protection of sensitive authentication data during document retrieval. API keys associated with authentication documents are made available through a read path to users who have access to the documents but are not necessarily authorized to obtain the credentials themselves.
This maps primarily to CWE-201: Insertion of Sensitive Information Into Sent Data, because secret credentials are included in data returned to an unauthorized recipient. It also relates to CWE-862: Missing Authorization, where the system does not sufficiently distinguish ordinary document-read permission from permission to access embedded authentication secrets.
The underlying issue is insufficient protection of sensitive authentication data during document retrieval. API keys associated with authentication documents are made available through a read path to users who have access to the documents but are not necessarily authorized to obtain the credentials themselves.
This maps primarily to CWE-201: Insertion of Sensitive Information Into Sent Data, because secret credentials are included in data returned to an unauthorized recipient. It also relates to CWE-862: Missing Authorization, where the system does not sufficiently distinguish ordinary document-read permission from permission to access embedded authentication secrets.
Potential impact
- Attackers may impersonate affected user accounts through exposed API keys
- Unauthorized users could access or modify resources permitted to the compromised accounts
- Compromised accounts may enable privilege escalation within the application
- Data confidentiality and integrity could be affected
- Long-lived exposed keys can increase the duration of unauthorized access
- Attackers may impersonate affected user accounts through exposed API keys
- Unauthorized users could access or modify resources permitted to the compromised accounts
- Compromised accounts may enable privilege escalation within the application
- Data confidentiality and integrity could be affected
- Long-lived exposed keys can increase the duration of unauthorized access
General mitigation guidance
Mitigation generally focuses on separating document visibility from credential visibility and reducing trust in client-accessible data.
Common defensive patterns include:
- Excluding API keys and other secrets from ordinary document responses by default
- Applying field-level authorization to authentication credentials
- Requiring explicit, narrowly scoped authorization for secret retrieval
- Returning only the minimum data needed for each API operation
- Using short-lived, narrowly scoped credentials where practical
- Supporting prompt credential rotation and revocation
- Applying least-privilege roles to accounts whose keys may be exposed
- Treating authentication documents as restricted security records rather than ordinary readable content
Mitigation generally focuses on separating document visibility from credential visibility and reducing trust in client-accessible data.
Common defensive patterns include:
- Excluding API keys and other secrets from ordinary document responses by default
- Applying field-level authorization to authentication credentials
- Requiring explicit, narrowly scoped authorization for secret retrieval
- Returning only the minimum data needed for each API operation
- Using short-lived, narrowly scoped credentials where practical
- Supporting prompt credential rotation and revocation
- Applying least-privilege roles to accounts whose keys may be exposed
- Treating authentication documents as restricted security records rather than ordinary readable content
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and schema checks that identify secret fields included in public or ordinary read responses
- Code review of authentication-document serializers, access hooks, and field-level authorization rules
- API tests verifying that users with document-read access cannot retrieve API keys
- Policy enforcement that blocks credential fields from client-facing responses unless explicitly authorized
- Audit-log review for unusual reads of authentication documents followed by API activity using previously inactive or uncommon credentials
- Automated security testing that compares document-level permissions with secret-field permissions
Organizations can look for this class of issue through:
- Static analysis and schema checks that identify secret fields included in public or ordinary read responses
- Code review of authentication-document serializers, access hooks, and field-level authorization rules
- API tests verifying that users with document-read access cannot retrieve API keys
- Policy enforcement that blocks credential fields from client-facing responses unless explicitly authorized
- Audit-log review for unusual reads of authentication documents followed by API activity using previously inactive or uncommon credentials
- Automated security testing that compares document-level permissions with secret-field permissions
