CVE-2026-105859: Payload: Unauthorized update to collection documents

October 7, 2026

An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control.

You are affected if:

You are configuring orderable: true with any collection or join field.

References

github.com/advisories/GHSA-f7hx-52q9-hcrf
github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf
nvd.nist.gov/vuln/detail/CVE-2026-105859

Code Behaviors & Features

Detect and mitigate CVE-2026-105859 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →