{"id":"EUVD-2026-93503","enisaUuid":"3779dcd1-bca1-30eb-a628-a49f46432fe6","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:31:52 PM","dateUpdated":"Oct 6, 2026, 5:37:22 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf\nhttps://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105859\nGHSA-f7hx-52q9-hcrf\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"80303889-15cd-3117-8042-475830fb1b57","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"aae02855-8790-3e4a-840e-831e190f0e81","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"enisaIdVendor":[{"id":"42d16cf6-7418-31d9-b333-43e5b2b00c03","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"3bfc4d5e-627e-366a-aa90-6cd2386009b0","vulnerability":{"id":"GHSA-f7hx-52q9-hcrf","description":"Payload: Unauthorized update to collection documents","datePublished":"Oct 7, 2026, 8:28:27 PM","dateUpdated":"Oct 7, 2026, 8:28:27 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105859\nhttps://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93503\n","aliases":"GHSA-f7hx-52q9-hcrf\nCVE-2026-105859\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6c11fd94-c119-365a-908c-8e9e0d502304","vulnerability":{"id":"CVE-2026-105859","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:31:52 PM","dateUpdated":"Oct 6, 2026, 5:37:22 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf\nhttps://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93503\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 6, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"0fbde1a7-6c8a-3b67-8a18-66f49d6d643c","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"e744c191-b061-35fc-abbf-a7237b0d3c93","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"vulnerabilityVendor":[{"id":"ce402267-8759-3b19-828d-03f38bfb3d76","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}