CVE-2026-106100

Summary

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.

Affected Software

VendorProductVersion RangeStatus
payloadcmspayload< 3.87.0affected
payloadcmspayload>= 4.0.0-canary.0, < 4.0.0-canary.20affected

Weaknesses

  • CWE-639: CWE-639: Authorization Bypass Through User-Controlled Key
  • CWE-915: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References