CVE-2026-106100 Payload: Field-level write access bypass in Payload on MongoDB
Authenticated users can bypass field-level write access controls to modify restricted fields in Payload CMS when using the MongoDB adapter.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106100?
CVE-2026-106100 is a high-severity missing authorization vulnerability in payloadcms payload, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.
Which versions are affected by CVE-2026-106100?
4 open source packages ship an affected version, including @payloadcms/db-mongodb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@payloadcms/db-mongodb npm | All versions | 3.87.0 |
@payloadcms/db-mongodb npm | All versions | 3.87.0 |
@payloadcms/db-mongodb npm | From 4.0.0-canary.0 | 4.0.0-canary.20 |
@payloadcms/db-mongodb npm | From 4.0.0-canary.0 | 4.0.0-canary.20 |
Products include Payloadcms Payload.
How do I fix CVE-2026-106100?
Upgrade @payloadcms/db-mongodb to a fixed version for your release line: 3.87.0 or 4.0.0-canary.20.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-106100 being exploited?
There is no known exploitation of CVE-2026-106100 in the wild and no public exploit code.
Other vulnerabilities in payloadcms payload
- CVE-2026-105857 Payload: RCE in Payload Form Builder
- CVE-2026-105859 Payload: Unauthorized update to collection documents
- CVE-2026-25544 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
- CVE-2022-27952 Unrestricted Upload of File with Dangerous Type in Payload
- CVE-2026-105851 Payload: Field access control bypass on auth collections
Sources
Also known as GHSA-4ww4-68q3-h7g5.