Summary
Payload: Unauthorized update to collection documents
Advisory details
Impact
An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control.
You are affected if:
- You are configuring
orderable: truewith any collection or join field.
Patches
In the patched version access control is properly enforced.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
References
- https://github.com/advisories/GHSA-f7hx-52q9-hcrf
- https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf
- https://nvd.nist.gov/vuln/detail/CVE-2026-105859
- https://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409
- https://github.com/payloadcms/payload/releases/tag/v3.90.0
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-107850
Contao: Improper access control in the preview links module
- HIGHCVE-2026-91985
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
- MEDIUMCVE-2026-105698
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
- MEDIUMCVE-2026-46438
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
- HIGHCVE-2026-76089
Formie: Missing authorization on sent notification resend modal exposes submission PII
- HIGHCVE-2026-76087
Formie: Unauthenticated users can overwrite incomplete submissions via submit action