EUVD-2026-93515

Payload: Field-level write access bypass in Payload on MongoDB...

GHSA-4WW4-68Q3-H7G5 Payload: Field-level write access bypass in Payload on MongoDB

Impact A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update. You are affected if: Payload version 3.87.0 or a 4.0.0-canary release before 4.0.0-canary.20 using the MongoDB adapter...

Payload: Field-level write access bypass in Payload on MongoDB

Impact A vulnerability in field-level access control could allow an authenticated user to modify fields they are not permitted to change on documents they can otherwise update. You are affected if: Payload version 3.87.0 or a 4.0.0-canary release before 4.0.0-canary.20 using the MongoDB adapter...

@contentql/core (>=0.1.2, <=0.3.4), @frogbotai/db-mongodb (>=0.0.1, <=0.21.0) +3 more potentially affected by CVE-2026-106100 via @payloadcms/db-mongodb (>=3.0.0-beta.48, <=3.85.1)

@payloadcms/db-mongodb NPM version =3.0.0-beta.48, =0.1.2, =0.0.1, =0.1.0, =0.1.4, =0.1.5 Source cves: CVE-2026-106100 Source advisory: OSV:GHSA-4WW4-68Q3-H7G5...

@contentql/core (>=0.1.2, <=0.3.4), @frogbotai/db-mongodb (>=0.0.1, <=0.21.0) +3 more potentially affected by CVE-2026-106100 via @payloadcms/db-mongodb (>=3.0.0-beta.48, <=3.85.1)

@payloadcms/db-mongodb NPM version =3.0.0-beta.48, =0.1.2, =0.0.1, =0.1.0, =0.1.4, =0.1.5 Source cves: CVE-2026-106100 Source advisory: GHSA-4WW4-68Q3-H7G5...

@contentql/core (>=0.1.2, <=0.3.4), @frogbotai/db-mongodb (>=0.0.1, <=0.21.0) +3 more potentially affected by CVE-2026-106100 via @payloadcms/db-mongodb (>=3.0.0-beta.48, <=3.85.1)

@payloadcms/db-mongodb NPM version =3.0.0-beta.48, =0.1.2, =0.0.1, =0.1.0, =0.1.4, =0.1.5 Source cves: CVE-2026-106100 Source advisory: SNYK:JS-PAYLOADCMSDBMONGODB-20936878...

CVE-2026-106100

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...

CVE-2026-106100

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...

CVE-2026-106100 Payload: Field-level write access bypass in Payload on MongoDB

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...

@contentql/core (>=0.1.2, <=0.3.4), @frogbotai/db-mongodb (>=0.0.1, <=0.21.0) +5 more potentially affected by CVE-2026-106100 via @payloadcms/db-mongodb (>=1.7.5, <=3.85.1)

@payloadcms/db-mongodb NPM version =1.7.5, =0.1.2, =0.0.1, =0.1.0, =0.1.0, =0.1.4, =0.0.1-beta.1, =0.0.1-beta.5 Source cves: CVE-2026-106100 Source advisory: MEND:CVE-2026-106100...

CVE-2026-106100

The Payload headless content management system contains a field-level write access control bypass in the @payloadcms/db-mongodb adapter. Specifically, versions before 3.87.0 and canary versions before 4.0.0-canary.20 allow an authenticated user with document update permissions to modify restricte...

@contentql/core (>=0.1.2, <=0.3.4), @frogbotai/db-mongodb (>=0.0.1, <=0.23.0) +3 more potentially affected by CVE-2026-105852 via @payloadcms/db-mongodb (>=3.0.0-beta.48, <=3.88.0)

@payloadcms/db-mongodb NPM version =3.0.0-beta.48, =0.1.2, =0.0.1, =0.1.0, =0.1.4, =0.1.5 Source cves: CVE-2026-105852 Source advisory: SNYK:JS-PAYLOADCMSDBMONGODB-20571385...

Missing Authorization

Overview @payloadcms/db-mongodb is a The officially supported MongoDB database adapter for Payload Affected versions of this package are vulnerable to Missing Authorization via the contains query operator on relationship, upload, and join fields, where access control filters injected for a relate...

CVE-2026-106100: Authorization Bypass Through User-Controlled Key

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...