CVE-2026-105851 Payload: Field access control bypass on auth collections
Attackers can bypass field access controls to read hidden or restricted data during document duplication in Payload CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105851?
CVE-2026-105851 is a critical missing authorization vulnerability in payloadcms payload, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Which versions are affected by CVE-2026-105851?
It affects 1 product.
Products include Payloadcms Payload.
How do I fix CVE-2026-105851?
No fix has been published for CVE-2026-105851 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-105851 being exploited?
There is no known exploitation of CVE-2026-105851 in the wild and no public exploit code.
Other vulnerabilities in payloadcms payload
- CVE-2026-105857 Payload: RCE in Payload Form Builder
- CVE-2026-105859 Payload: Unauthorized update to collection documents
- CVE-2026-25544 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
- CVE-2022-27952 Unrestricted Upload of File with Dangerous Type in Payload
- CVE-2026-105863 Payload authentication token field handling issue
Sources
Also known as GHSA-vc4h-q48j-5hcx.