~ / search / GHSA-f7hx-52q9-hcrf

GHSA-f7hx-52q9-hcrf

Payload: Unauthorized update to collection documents

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-105859

Packages

EcosystemPackageAffectedFixed in
npm payload < 3.90.0 3.90.0
npm payload >= 4.0.0-canary.0, < 4.0.0-canary.34 4.0.0-canary.34

Details

As written in the advisory (Markdown source, shown as plain text).

## Impact An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control. **You are affected if:** - You are configuring `orderable: true` with any collection or join field. ## Patches In the patched version access control is properly enforced. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

References

External links from the advisory. They lead to third-party sites.