CVE-2026-106100: Payload: Field-level write access bypass in Payload on MongoDB
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@payloadcms/db-mongodbto a version that resolves this vulnerability.Fixed in 3.87.0 - Upgrade
Upgrade
@payloadcms/db-mongodbto a version that resolves this vulnerability.Fixed in 4.0.0-canary.20
Event History
Frequently Asked Questions
Which deployments are affected?
Only Payload deployments using the @payloadcms/db-mongodb adapter are affected. The Postgres and SQLite adapters are not affected.
What level of access does an attacker need?
An attacker must be authenticated and already have permission to update a document. They can then modify fields for which field-level write access control should deny them write permission.
What versions contain the fix?
Upgrade the MongoDB adapter to version 3.87.0 or later, or to 4.0.0-canary.20 or later for canary releases.