CVE-2026-105851: CWE-284: Improper Access Control in payloadcms payload
Description
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
CVSS v4.0
Score 9.3critical
Affected software
payloadcms
payload
pkg:github/payloadcms/payloadRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PayloadCMS, a headless content management system, has an access control vulnerability (CWE-284) in its duplicate operation affecting versions >=3.0.0 <3.90.0 and >=4.0.0-canary.0 <4.0.0-canary.34. The duplicate operation improperly copies field values from source documents despite access.read or access.create rules denying such access, including for hidden fields. The disableDuplicate configuration does not mitigate this issue. This vulnerability is resolved in versions 3.90.0 and 4.0.0-canary.34.
Potential Impact
An attacker or unauthorized user can bypass access control restrictions during the duplicate operation, potentially exposing or copying sensitive data from fields that should be inaccessible. This undermines the confidentiality and integrity of the data managed by PayloadCMS. The CVSS 4.0 score of 9.3 (critical) reflects the high impact due to network attack vector, no privileges required, and high impact on confidentiality and integrity.
Mitigation Recommendations
Upgrade to PayloadCMS version 3.90.0 or later, or 4.0.0-canary.34 or later, where this vulnerability is fixed. The disableDuplicate setting does not prevent this issue, so relying on it is insufficient. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-05T23:06:29.748Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac51f772cdf04f656c32846
Added to database: 10/06/2026, 16:19:03 UTC
Last enriched: 10/06/2026, 16:33:18 UTC
Last updated: 10/06/2026, 18:57:27 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.