{"id":"GHSA-f7hx-52q9-hcrf","revision":"6b206b2858f24a3eab24a5bde354a7f5","records":[{"revision":"6b206b2858f24a3eab24a5bde354a7f5","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-f7hx-52q9-hcrf","aliases":["CVE-2026-105859"],"title":"Payload: Unauthorized update to collection documents","description":"## Impact\n\nAn attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control.\n\n**You are affected if:**\n\n- You are configuring `orderable: true` with any collection or join field.\n\n## Patches\n\nIn the patched version access control is properly enforced.\n\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.","state":0,"publishedAt":"2026-10-07T20:28:27+00:00","modifiedAt":"2026-10-07T20:45:05.3360336+00:00","affected":[{"ecosystem":"npm","name":"payload","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.90.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"payload","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0-canary.0"},{"kind":"fixed","version":"4.0.0-canary.34"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf","https://nvd.nist.gov/vuln/detail/CVE-2026-105859","https://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409","https://github.com/payloadcms/payload","https://github.com/payloadcms/payload/releases/tag/v3.90.0"],"sourceUrl":"https://github.com/advisories/GHSA-f7hx-52q9-hcrf","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f7hx-52q9-hcrf","identifiers":["GHSA-f7hx-52q9-hcrf","CVE-2026-105859"]},"retained":false,"historicalAffected":[]}],"coverage":[]}