Privilege Escalation in Payload CMS via Unauthorized Collection Updates

Executive Summary

This vulnerability affects Payload, a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can exploit an update endpoint to modify collection documents without proper access control when the 'orderable' feature is enabled on a collection or join field.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Payload CMS version is before 3.90.0 or canary versions before 4.0.0-canary.34. Verify if the 'orderable' setting is enabled on any collection or join field. Inspect network logs for unauthorized requests to update endpoints modifying collection documents without proper access control.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to alter sensitive data in your Payload CMS without authorization. This could lead to unauthorized changes, data corruption, or exposure of confidential information, depending on the content managed by the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by allowing unauthorized modifications to sensitive data. Unauthorized changes may result in data breaches, loss of integrity, or failure to meet regulatory standards for data protection and access control.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Payload CMS to version 3.90.0 or later for stable releases, or to 4.0.0-canary.34 or later for canary releases. Disable the orderable feature on affected collections or join fields if upgrading is not immediately possible.

Useful 0 Not Useful 0