Payload: Field-level write access bypass in Payload on MongoDB
### Impact A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update. You are affected if: Payload version < `3.87.0` (or a `4.0.0-canary` release before `4.0.0-canary.20`) using the MongoDB adapter (`@payloadcms/db-mongodb`) with any collection that relies on field-level access control to restrict writes under certain conditions. Relational adapters (Postgres, SQLite) are not affected. ### Patches Handling of incoming field data has been hardened so field-level access control is enforced consistently. Users should upgrade to `3.87.0` (or `4.0.0-canary.20` on the `4.x` line) or later. ### Workarounds There is no complete workaround. Upgrading to `3.87.0` (or `4.0.0-canary.20` on the `4.x` line) is recommended.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-106100US | — | — | ||
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/payloadcms/payloadPACKAGE
- https://github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941WEB
- https://github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935WEB
- https://github.com/payloadcms/payload/releases/tag/v3.87.0WEB
- https://github.com/payloadcms/payload/security/advisories/GHSA-4ww4-68q3-h7g5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-106100ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan