CriticalCritical vulnerability
CVE-2026-105859: Payload: Unauthorized update to collection documents
GitHub Advisories · officialPublished Oct 7, 2026Risk 50/100
## Impact An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control. **You are affected if:** - You are configuring `orderable: true` with any collection or join field. ## Patches In the patched version access control is properly enforced. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
Recommended action
Recommended action
Upgrade affected packages to a patched version: payload 3.90.0, payload 4.0.0-canary.34.
Technical details
- Vendor
- Not specified
- Product
- payload
- Exploitation
- none known
- Evidence
- official
CVSS
9.8
Evidence and sources
This record is attributed to GitHub Advisories. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source