Riskcovery

CVE-2026-106100

Payload: Field-level write access bypass in Payload on MongoDB

State
Published
Severity
7.1 High
Published
Oct 6, 2026
Updated
Oct 6, 2026
Reserved
Oct 6, 2026

Read the record on cve.org

Description

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:NGitHub_M

Weaknesses

  • CWE-639 Authorization Bypass Through User-Controlled Key
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected Products

ProductVersions
payloadpayloadcms
  • < 3.87.0Affected
  • >= 4.0.0-canary.0, < 4.0.0-canary.20Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.