Payload: Field-level write access bypass in Payload on MongoDB
Impact
A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update.
You are affected if:
Payload version < 3.87.0 (or a 4.0.0-canary release before 4.0.0-canary.20) using the MongoDB adapter (@payloadcms/db-mongodb) with any collection that relies on field-level access control to restrict writes under certain conditions.
Relational adapters (Postgres, SQLite) are not affected.
Patches
Handling of incoming field data has been hardened so field-level access control is enforced consistently.
Users should upgrade to 3.87.0 (or 4.0.0-canary.20 on the 4.x line) or later.
Workarounds
There is no complete workaround. Upgrading to 3.87.0 (or 4.0.0-canary.20 on the 4.x line) is recommended.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @payloadcms/db-mongodb | < 3.87.0, >= 4.0.0-canary.0, < 4.0.0-canary.20 | 3.87.0, 4.0.0-canary.20 |
References
- https://github.com/payloadcms/payload/security/advisories/GHSA-4ww4-68q3-h7g5
- https://nvd.nist.gov/vuln/detail/CVE-2026-106100
- https://github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941
- https://github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935
- https://github.com/payloadcms/payload
- https://github.com/payloadcms/payload/releases/tag/v3.87.0
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N- Weakness (CWE)
CWE-639, CWE-915- Platform
- npm
- Package
@payloadcms/db-mongodb- Disclosed
- 07.10.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-4ww4-68q3-h7g5 - CC BY 4.0
Vulnerability history: @payloadcms/db-mongodb
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.