Report

Should I Use Payload?

payloadcms.com·Analyzed 15 hours ago·9/20/2026·Based on 12 sources

Built with TypeScript and React, Payload is an open-source headless CMS and application framework. Build anything.

Depends

Buy if you have React/TypeScript developers who want a code-first CMS they can self-host.

Powerful code-first CMS devs rate 4.9/5, but it needs React skills, self-hosting for value, and the roadmap is murky.

Confidence: Medium

4.9/5

G2 rating

59 reviews

Yes

Free tier

Open-source core, self-hosted

$9M Series A

Funding

VC-backed startup

394

Companies using

Tracked by TheirStack

Value for money

Free open-source core; cloud hosting costs draw complaints

Ease of use

Code-first setup; developers report friction

Feature depth

Config-driven CMS that extends into full apps

Support quality

Active community; vendor support evidence thin

Security posture

Recent CVEs, patched; public disclosure process

Pros

Rated 4.9/5 across 59 G2 reviews^²
Free open-source core; self-host anywhere¹²
Native TypeScript/React fits teams without glue code^¹
Users consistently praise flexibility and extensibility^³

Cons

Steep learning curve without knowledge
Cloud hosting pricing draws repeated complaints^⁵
Figma acquisition leaves roadmap uncertain; users exploring alternatives^⁷
Small review base versus bigger CMS rivals^²
Some developers find the admin experience painful^⁶

Gotchas

highAuth bypass and RCE CVEs fixed in 3.79.1+; always run latest version
mediumCloud pricing is the top complaint; self-host to control costs^⁵
mediumSelf-hosting means upgrades, backups, and patches are your job¹²
mediumPost-Figma roadmap uncertainty has users evaluating alternatives already¹¹

Best for

and React dev teams
Custom apps that need a CMS
Complex marketing sites
Teams wanting self-hosting control

Not for

Marketers wanting a plug-and-play WordPress swap
Non-technical teams without React developers
Simple blogs or contact sites — WordPress or Ghost cost less effort
Risk-averse buyers spooked by the Figma acquisition

Companies that use it

Sonos
DigitalOcean
Blue Origin

Pricing

Open-source / self-hosted

Free

Full CMS and admin UI
You manage hosting and updates

Payload Cloud

Paid managed hosting

Hosted for you
Frequently called out as expensive

Security

Recent auth bypass and RCE CVEs patched in 3.79.1+; security page exists.

CVE-2026-25574: Auth bypass vulnerabilityDisclosed authentication bypass affecting Payload CMS.^⁸
CVE-2026-25544: Remote code executionCritical RCE patched in version 3.79.1 and later.^⁹

What users say

Users rate Payload extremely highly on flexibility, but flag the React learning curve, cloud pricing, and post-acquisition uncertainty.

“Is payload CMS a good option for me if I don't know nextjs?”

— Reddit, r/PayloadCMS

“Anyone else find Payload CMS a pain?”

— Reddit, r/nextjs

“Which CMS to use now? The future of Payload is uncertain”

— Reddit, r/nextjs

Alternatives

Compare Payload with each alternative.

Strapi

Open-source headless CMS with a larger community

Payload vs Strapi

Sanity

Hosted headless CMS, generous free tier

Directus

Open-source, data-first alternative compared head-to-head

Payload vs Directus

Contentful

Mature SaaS headless CMS, less code required

Payload vs Contentful

Full analysis

Based on ~15 usable public sources; many 'payload' search results (space, cybersecurity jargon, a separate payments company) were excluded as unrelated.