CVE-2026-105859: Payload: Unauthorized update to collection documents

Payload's orderable option adds an endpoint that moves documents to a new position in a sorted collection. That endpoint, addOrderableEndpoint, ran the collection's update access check only once, against the first document in the batch, with empty data. It then wrote the order change without enforcing access on the update itself. A request to this endpoint could therefore change documents the caller has no right to edit, including documents that the update rule protects.

The advisory rates this 9.8: network reachable, no privileges, no user interaction. In practice, anyone who can reach your Payload API can modify content in an orderable collection. That includes published pages, product listings or any collection that drives a site. The advisory describes updates to collection documents. It does not describe reading data or running code.

Affected: payload below 3.90.0, and 4.0.0-canary.0 up to but not including 4.0.0-canary.34. Your project is exposed only if a collection or join field sets orderable: true. Search your config for that string.

Check the installed version:

npm ls payload

Check all other @payloadcms/* packages too, since they are released in step with the core.

Upgrade payload to 3.90.0, or to 4.0.0-canary.34 on the v4 canary line. Upgrade the other Payload packages to the same version.

npm install [email protected]

The fix (commit 36fa9af) runs the collection's access.update for every affected document with its proposed order value, rejects the request with Forbidden if no document matches, and passes overrideAccess: false to the update calls. The advisory lists no workaround. Removing orderable: true is a stopgap that follows from the affected-configuration condition, not a vendor recommendation.

Look in your request logs for calls to the orderable reorder endpoint on collections you configured with orderable: true, especially from unauthenticated sessions or from users who lack update rights. Then compare the order field values of documents that your access.update rules protect against a known-good backup or version history. Unexpected order changes on protected documents point to abuse. The advisory publishes no exploit indicators.

Impact

An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control.

You are affected if:

• You are configuring orderable: true with any collection or join field.

Patches

In the patched version access control is properly enforced.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.