CVE-2026-106100: Payload: Field-level write access bypass in Payload on MongoDB
A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update.
You are affected if:
Payload version < 3.87.0 (or a 4.0.0-canary release before 4.0.0-canary.20) using the MongoDB adapter (@payloadcms/db-mongodb) with any collection that relies on field-level access control to restrict writes under certain conditions.
Relational adapters (Postgres, SQLite) are not affected.
References
- github.com/advisories/GHSA-4ww4-68q3-h7g5
- github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941
- github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935
- github.com/payloadcms/payload/releases/tag/v3.87.0
- github.com/payloadcms/payload/security/advisories/GHSA-4ww4-68q3-h7g5
- nvd.nist.gov/vuln/detail/CVE-2026-106100
Code Behaviors & Features
Detect and mitigate CVE-2026-106100 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →