{"schema":"threatline.record/2","record":{"id":"CVE-2026-105851","aliases":["GHSA-vc4h-q48j-5hcx"],"summary":"Payload: Field access control bypass on auth collections","details":"## Impact\n\nPayload's duplicate operation copies field values from the source document even when a field is hidden, or its `access.read` or `access.create` rule would reject the value for that caller.\n\nThe `disableDuplicate` collection setting, enabled by default on auth collections, did not stop this.\n\n## Patches\n\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.\n\n## Workarounds\n\nAdd a beforeDuplicate field hook to fields and set the value to empty or your default value.","categories":["Libraries & packages"],"product":"payload","vendor":"payloadcms","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vc4h-q48j-5hcx","source_modified_at":"2026-10-06T16:17:25Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"payload"},"range":"> 3.0.0, < 3.90.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vc4h-q48j-5hcx","source_modified_at":"2026-10-06T16:17:25Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"payload"},"range":"> 4.0.0-canary.0, < 4.0.0-canary.34"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105851","source_modified_at":"2026-10-06T17:39:29.558Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"payload","vendor":"payloadcms","versions":[{"version":"> 3.0.0, < 3.90.0","status":"affected"},{"version":"> 4.0.0-canary.0, < 4.0.0-canary.34","status":"affected"}],"defaultStatus":null}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vc4h-q48j-5hcx","source_modified_at":"2026-10-06T16:17:25Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"payload"},"version":"3.90.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-vc4h-q48j-5hcx","source_modified_at":"2026-10-06T16:17:25Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"payload"},"version":"4.0.0-canary.34"}],"cvss":9.3,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00249,"percentile":0.1535,"score_date":"2026-10-23"},"published_at":"2026-10-06T16:13:11.367Z","modified_at":"2026-10-06T17:39:29.558Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-vc4h-q48j-5hcx","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T16:17:25Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105851","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-06T17:39:29.558Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105851","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/payloadcms/payload/security/advisories/GHSA-vc4h-q48j-5hcx","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/payloadcms/payload/commit/099ef12e2682f076aa8e8d0ccb790536b4e1027f","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-vc4h-q48j-5hcx","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-06T17:34:36.004571Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-06T17:39:29.558Z","content_hash":"f22b0cf149cafa77db27a23bd26eb585866f176ba4ceeb2f64407961d0252786"}}