payloadcms/payload · Security
Payload: Field access control bypass on auth collections
- GHSA ID
- GHSA-vc4h-q48j-5hcx
- CVE ID
- CVE-2026-105851
- Severity
- critical
- Published
- Updated
- CVSS v4
- 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N
Description
Impact
Payload's duplicate operation copies field values from the source document even when a field is hidden, or its access.read or access.create rule would reject the value for that caller.
The disableDuplicate collection setting, enabled by default on auth collections, did not stop this.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Add a beforeDuplicate field hook to fields and set the value to empty or your default value.
CWEs
- CWE-284 · Improper Access Control
- CWE-863 · Incorrect Authorization