CVE-2026-105851: Payload: Field access control bypass on auth collections

October 6, 2026

Payload’s duplicate operation copies field values from the source document even when a field is hidden, or its access.read or access.create rule would reject the value for that caller.

The disableDuplicate collection setting, enabled by default on auth collections, did not stop this.

References

github.com/advisories/GHSA-vc4h-q48j-5hcx
github.com/payloadcms/payload/commit/099ef12e2682f076aa8e8d0ccb790536b4e1027f
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-vc4h-q48j-5hcx
nvd.nist.gov/vuln/detail/CVE-2026-105851

Code Behaviors & Features

Detect and mitigate CVE-2026-105851 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →