{"id":"EUVD-2026-93515","enisaUuid":"b2ad980d-ed08-3ec3-a666-1bddcebfd774","description":"Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.","datePublished":"Oct 6, 2026, 4:56:55 PM","dateUpdated":"Oct 6, 2026, 5:28:55 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-4ww4-68q3-h7g5\nhttps://github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941\nhttps://github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935\nhttps://github.com/payloadcms/payload/releases/tag/v3.87.0\n","aliases":"CVE-2026-106100\nGHSA-4ww4-68q3-h7g5\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"389ab662-84a1-3df3-be7c-7ee08968e487","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.20"},{"id":"c4c7afb5-68ab-3e76-8f9f-3a5bec3eefd1","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.87.0"}],"enisaIdVendor":[{"id":"6fd614d2-5e46-31ee-b211-99979a892c4c","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"0562f82f-3b64-3f6a-9923-97c7a5af1d1e","vulnerability":{"id":"GHSA-4ww4-68q3-h7g5","description":"Payload: Field-level write access bypass in Payload on MongoDB","datePublished":"Oct 7, 2026, 4:19:57 PM","dateUpdated":"Oct 7, 2026, 4:19:57 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-4ww4-68q3-h7g5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106100\nhttps://github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941\nhttps://github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.87.0\n","enisa_id":"EUVD-2026-93515\n","aliases":"CVE-2026-106100\nGHSA-4ww4-68q3-h7g5\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"da399e88-715f-31b7-9979-8e1878f1c094","vulnerability":{"id":"CVE-2026-106100","description":"Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.","datePublished":"Oct 6, 2026, 4:56:55 PM","dateUpdated":"Oct 6, 2026, 5:28:55 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-4ww4-68q3-h7g5\nhttps://github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941\nhttps://github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935\nhttps://github.com/payloadcms/payload/releases/tag/v3.87.0\n","enisa_id":"EUVD-2026-93515\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Nov 2, 2026, 7:17:06 AM","vulnerabilityProduct":[{"id":"8d564398-d431-3132-850e-52ee583b9cb6","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.87.0"},{"id":"cf7f136c-b2d3-325b-bd0e-cf1cfc2fcbdb","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.20"}],"vulnerabilityVendor":[{"id":"70ab898b-822b-3e5d-b4f4-724eb0576b20","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}