All vulnerabilities
CVE-2026-106100GHSA-4ww4-68q3-h7g5

@payloadcms/db-mongodb: Payload: Field-level write access bypass in Payload on MongoDB

payloadcms @payloadcms/db-mongodbnpmDatabases
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.87.0Also 4.0.0-canary.20GitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 3.87.0@payloadcms/db-mongodb, npmGitHubnpm install @payloadcms/db-mongodb@3.87.0
  • 4.0.0-canary.20@payloadcms/db-mongodb, npmGitHubnpm install @payloadcms/db-mongodb@4.0.0-canary.20

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update.

You are affected if: Payload version < 3.87.0 (or a 4.0.0-canary release before 4.0.0-canary.20) using the MongoDB adapter (@payloadcms/db-mongodb) with any collection that relies on field-level access control to restrict writes under certain conditions.

Relational adapters (Postgres, SQLite) are not affected.

Patches

Handling of incoming field data has been hardened so field-level access control is enforced consistently.

Users should upgrade to 3.87.0 (or 4.0.0-canary.20 on the 4.x line) or later.

Workarounds

There is no complete workaround. Upgrading to 3.87.0 (or 4.0.0-canary.20 on the 4.x line) is recommended.

Text from GitHub Advisory Database

Affected versions 6

  • @payloadcms/db-mongodb, npm< 3.87.0GitHub
  • @payloadcms/db-mongodb, npm>= 4.0.0-canary.0, < 4.0.0-canary.20GitHub
  • payloadaffected: < 3.87.0CVE List
  • payloadaffected: >= 4.0.0-canary.0, < 4.0.0-canary.20CVE List
  • @payloadcms/db-mongodb, npmfrom first release, fixed in 3.87.0OSV
  • @payloadcms/db-mongodb, npmfrom 4.0.0-canary.0, fixed in 4.0.0-canary.20OSV

References 6