Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
References
| Link | Resource |
|---|---|
| https://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409 | Patch |
| https://github.com/payloadcms/payload/releases/tag/v3.90.0 | Patch Release Notes |
| https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Oct 2026, 00:10
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409 - Patch | |
| References | () https://github.com/payloadcms/payload/releases/tag/v3.90.0 - Patch, Release Notes | |
| References | () https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf - Vendor Advisory | |
| First Time |
Payloadcms payload
Payloadcms |
|
| CPE | cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:* |
06 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 17:17
Updated : 2026-10-15 00:10
NVD link : CVE-2026-105859
Mitre link : CVE-2026-105859
CVE.ORG link : CVE-2026-105859
JSON object : View
Products Affected
payloadcms
- payload