CVE-2026-105851 in Payload
Summary
by MITRE • 10/06/2026
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
Payload CMS, a widely adopted headless content management system built on Node.js, contains a critical authorization flaw affecting version ranges from 3.0.0 up to but not including 3.90.0, as well as canary releases prior to 4.0.0-canary.34. The vulnerability manifests during the document duplication process, where the system fails to enforce access control rules when copying field values from a source document to a newly created duplicate. Specifically, if a particular field is configured with hidden visibility or restricted by strict read and create access permissions that would normally deny the current user's ability to view or modify that data, the duplication mechanism inadvertently bypasses these safeguards. This results in the unauthorized propagation of sensitive information into documents where such data should remain inaccessible, effectively allowing users to circumvent intended security boundaries through a standard administrative operation rather than exploiting complex injection techniques.
The technical root cause lies in how the internal logic handles field inheritance during copy operations. Instead of re-evaluating access control lists against the target context for each individual field, the system appears to blindly transfer values from the source object regardless of whether the caller has permission to interact with those specific fields. This behavior contradicts the principle of least privilege and fails to respect the configuration defined in the schema's access rules. The presence of a disableDuplicate setting further highlights the severity of this oversight; even when administrators explicitly attempt to restrict duplication capabilities, the underlying code path for copying data remains active and unfiltered regarding field-level permissions. This indicates that the security check was either missing entirely from the duplicate handler or implemented incorrectly such that it did not account for granular access control requirements during bulk data transfer operations.
From an operational impact perspective, this vulnerability enables unauthorized information disclosure and potential integrity violations within the CMS environment. Attackers with lower-privileged accounts can extract sensitive fields belonging to other users' documents by simply creating a duplicate entry in their own workspace. This could lead to the exposure of personally identifiable information, confidential business data, or internal system configurations depending on what is stored in the affected hidden or restricted fields. Furthermore, because the duplication process may also allow writing values that should be immutable for certain roles, it introduces risks related to privilege escalation and data tampering. The flaw undermines trust in the CMS's role as a secure repository of structured content, potentially violating compliance requirements such as GDPR or HIPAA if sensitive user data is leaked through this mechanism.
This issue aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing authorization policies during resource manipulation operations. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, where an attacker leverages legitimate credentials and system functionality to access restricted data without needing elevated privileges or external exploits. The vulnerability demonstrates how complex business logic features like document duplication can introduce subtle security gaps if not rigorously tested against all permission scenarios.
To mitigate this risk, organizations running affected versions of Payload CMS must upgrade immediately to version 3.90.0 or later for the stable branch, or 4.0.0-canary.34 and newer for development branches. These releases contain patches that ensure access control rules are properly evaluated during field copying operations, preventing unauthorized data transfer even when using duplicate functions. Until an upgrade is feasible, administrators should consider restricting user permissions to minimize exposure of sensitive fields and monitor audit logs for unusual duplication activities involving restricted content types. Regular security assessments focusing on authorization logic in bulk operation handlers are recommended to identify similar patterns in custom plugins or extensions that may interact with the core CMS functionality.