CVE-2026-106100
Received Received - Intake

Authenticated Field Write Bypass in Payload CMS

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-106100
EUVD
EUVD-2026-93515

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
payloadcms payload < 3.87.0
payloadcms payload >= 4.0.0-canary.0, < 4.0.0-canary.20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Payload is a headless CMS. In versions before 3.87.0 and canary 4.0.0-canary.20, an authenticated user with document update permissions can modify fields that field-level write access control should restrict. This bypasses intended restrictions. The Postgres and SQLite adapters are not affected.

Detection Guidance

To detect this vulnerability, check the version of @payloadcms/db-mongodb in your system. If you are using a version before 3.87.0 or a canary version before 4.0.0-canary.20, your system is vulnerable. Run commands like 'npm list @payloadcms/db-mongodb' or 'yarn list @payloadcms/db-mongodb' to check the installed version.

Impact Analysis

An attacker with valid credentials could alter restricted data fields, potentially leading to unauthorized changes in content, metadata, or sensitive information. This could compromise data integrity and confidentiality within the CMS.

Compliance Impact

This vulnerability could lead to unauthorized data modifications, violating integrity and access control requirements in GDPR and HIPAA. It may result in non-compliance due to insufficient protection against unauthorized changes to sensitive data.

Mitigation Strategies

Update @payloadcms/db-mongodb to version 3.87.0 or later for stable releases, or 4.0.0-canary.20 or later for canary releases. Ensure field-level write access controls are properly configured to restrict unauthorized document modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106100. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart