CVE-2026-105851Critical· 9.3▾ MidnightPayload: Field access control bypass on auth collections
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Payload's duplicate operation copies field values from the source document even when a field is hidden, or its access.read or access.create rule would reject the value for that caller.
The disableDuplicate collection setting, enabled by default on auth collections, did not stop this.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Add a beforeDuplicate field hook to fields and set the value to empty or your default value.
payload > 3.0.0, < 3.90.0payload > 4.0.0-canary.0, < 4.0.0-canary.34Upgrade to a patched release:
payload 3.90.0payload 4.0.0-canary.34Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105855High· 7.6Payload didn't enforce field-level password update restrictions
CVE-2026-105864Medium· 5.3Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant
CVE-2026-105847High· 7.1Payload: Polymorphic join queries could disclose hidden fields
CVE-2026-105850High· 8.8Payload: Order confirmation validation issue in Payload Ecommerce
CVE-2026-105852Medium· 6.9Payload relationship-query authorization bypass
CVE-2026-105853High· 7.1Payload: Token refresh and password reset responses may expose restricted user fields