Open-source package vulnerability · npm

CVE-2026-105851: Payload: Field access control bypass on auth collections

criticalCVSS 4.0 9.3GHSA-vc4h-q48j-5hcx

Impact Payload's duplicate operation copies field values from the source document even when a field is hidden, or its access.read or access.create rule would reject the value for that caller. The disableDuplicate collection setting, enabled by default on auth collections, did not stop this. Patches Users should upgrade Payload packages to = 3.90.0 or = 4.0.0-canary.34.

Published Oct 6, 2026

Affected packages

payload

Ecosystem: npm
Affected: > 3.0.0, < 3.90.0
Fixed in: 3.90.0
Check: npm ls payload

payload

Ecosystem: npm
Affected: > 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in: 4.0.0-canary.34
Check: npm ls payload

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

Payload's duplicate operation copies field values from the source document even when a field is hidden, or its access.read or access.create rule would reject the value for that caller.

The disableDuplicate collection setting, enabled by default on auth collections, did not stop this.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

Add a beforeDuplicate field hook to fields and set the value to empty or your default value.

Credited to Zerotistic.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More npm vulnerabilities

All npm entries