GHSA-4ww4-68q3-h7g5: SQL Injection

Q: Which deployments are affected?

Affected deployments use the MongoDB adapter (@payloadcms/db-mongodb) and have at least one collection that relies on field-level access control to conditionally restrict writes. Payload versions earlier than 3.87.0, and 4.0.0-canary releases before 4.0.0-canary.20, are affected; Postgres and SQLite adapters are not affected.

Q: What level of access does an attacker need?

An attacker must be authenticated and able to update the target document. They can then attempt to modify fields that field-level access control would normally prohibit them from changing.

Q: Is there a workaround if upgrading cannot happen immediately?

No complete workaround is available. Upgrade to 3.87.0 or later, or to 4.0.0-canary.20 or later on the 4.x canary line.

Published Oct 7, 2026

Updated

Impact A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update.

You are affected if: Payload version < 3.87.0 (or a 4.0.0-canary release before 4.0.0-canary.20) using the MongoDB adapter (@payloadcms/db-mongodb) with any collection that relies on field-level access control to restrict writes under certain conditions.

Relational adapters (Postgres, SQLite) are not affected.

Patches Handling of incoming field data has been hardened so field-level access control is enforced consistently.

Users should upgrade to 3.87.0 (or 4.0.0-canary.20 on the 4.x line) or later.

Workarounds There is no complete workaround. Upgrading to 3.87.0 (or 4.0.0-canary.20 on the 4.x line) is recommended.

Affected Software

2 affected componentsFixes available

npm/@payloadcms/db-mongodb>=4.0.0-canary.0<4.0.0-canary.20

4.0.0-canary.20

npm/@payloadcms/db-mongodb<3.87.0

3.87.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@payloadcms/db-mongodb to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.20
Upgrade
Upgrade npm/@payloadcms/db-mongodb to a version that resolves this vulnerability.
Fixed in 3.87.0
Upgrade
Upgrade Payload to a version that resolves this vulnerability.
Fixed in 3.87.0

Event History

Oct 7, 2026

Advisory Published

via GitHub·04:19 PM

Data Sourced

via GitHub·04:19 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are affected?

Affected deployments use the MongoDB adapter (@payloadcms/db-mongodb) and have at least one collection that relies on field-level access control to conditionally restrict writes. Payload versions earlier than 3.87.0, and 4.0.0-canary releases before 4.0.0-canary.20, are affected; Postgres and SQLite adapters are not affected.

What level of access does an attacker need?