Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M

CVE-2026-105851Payload: Field access control bypass on auth collections

Critical 9.3

In plain English

A critical-severity improper access control in payload from payloadcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.2%top 83.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Affected products (as reported)

Vendor	Product	Versions
payloadcms	payload	> 3.0.0, < 3.90.0> 4.0.0-canary.0, < 4.0.0-canary.34

Weakness: CWE-284, CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

References

https://github.com/payloadcms/payload/security/advisories/GHSA-vc4h-q48j-5hcx x_refsource_CONFIRM
https://github.com/payloadcms/payload/commit/099ef12e2682f076aa8e8d0ccb790536b4e1027f x_refsource_MISC
https://github.com/payloadcms/payload/releases/tag/v3.90.0 x_refsource_MISC