CVE-2026-105859: Payload: Unauthorized update to collection documents
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34
Event History
Frequently Asked Questions
Which deployments are exposed?
Payload deployments running versions earlier than 3.90.0, or canary versions earlier than 4.0.0-canary.34, are affected if an orderable collection or join field is enabled.
What does an attacker need to exploit this issue?
An attacker can submit a request to the affected update endpoint. The vulnerability does not require authentication, user interaction, or special privileges according to the supplied severity vector.
What access can an attacker bypass?
The affected endpoint can modify collection documents without enforcing collection-level or field-level access control when orderable is enabled on a collection or join field.
What is the remediation?
Upgrade to Payload 3.90.0 or later, or to 4.0.0-canary.34 or later for canary deployments. The provided information does not specify an alternative mitigation if upgrading is not immediately possible.