CVE-2026-105851: Payload: Field access control bypass on auth collections
Impact
Payload's duplicate operation copies field values from the source document even when a field is hidden, or its access.read or access.create rule would reject the value for that caller.
The disableDuplicate collection setting, enabled by default on auth collections, did not stop this.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Add a beforeDuplicate field hook to fields and set the value to empty or your default value.
Other sources
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Configuration
Add a beforeDuplicate field hook to fields and set the value to empty or your default value.
Payload fields beforeDuplicate = empty or your default value
Event History
Frequently Asked Questions
Which deployments are affected?
Payload versions from 3.0.0 before 3.90.0 and 4.0.0 canary versions before 4.0.0-canary.34 are affected. The issue applies when callers can use the duplicate operation on documents containing fields whose values should be hidden or rejected by field-level read or create access controls.
What does an attacker need to exploit this issue?
An attacker needs to be able to invoke Payload's duplicate operation on a source document. The operation can copy source field values despite hidden-field settings or access.read and access.create rules that would otherwise deny those values to that caller.
Does enabling disableDuplicate protect auth collections?
No. Although disableDuplicate is enabled by default on auth collections, it did not prevent this access-control bypass.
What can be done before upgrading?
Add a beforeDuplicate field hook to affected fields and set the value to empty or to an appropriate default value. Upgrade Payload packages to version 3.90.0 or later, or 4.0.0-canary.34 or later, when possible.