6 matches found
Missing Authorization
Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Missing Authorization via the reorder endpoint in packages/payload/src/config/orderable/index.ts, where access control checks on update operations are...
Payload: Unauthorized update to collection documents
Impact An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control. You are affected if: - You are configuring orderable: true with any collection or join field. Patches In the patched version...
CVE-2026-105859
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control...
CVE-2026-105859 Payload: Unauthorized update to collection documents
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control...
CVE-2026-105859 Payload: Unauthorized update to collection documents
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control...
CVE-2026-105859: Authorization Bypass Through User-Controlled Key
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control...