Payload CMS: Access control bypass in duplicate operation
Summary
The duplicate operation in Payload copies field values from the source document even when a field is hidden or its access.read or access.create rule rejects the value for the caller. The disableDuplicate setting, which is enabled by default on auth collections, does not prevent this. An attacker who can use the duplicate function may therefore obtain or create field values they are not authorised to access, such as role fields on user collections.
Affected
- Payload versions from 3.0.0 before 3.90.0
- Payload canary versions from 4.0.0-canary.0 before 4.0.0-canary.34
Fixed in
- Payload 3.90.0
- Payload 4.0.0-canary.34
Workaround
- Add a beforeDuplicate field hook to the affected fields that sets the value to empty or to your default value (vendor-listed; coverage not independently verified)
- Disabling duplicate via disableDuplicate is not effective
- Unknown whether further workarounds exist
Exploitation
- No evidence of exploitation in the wild found; CISA KEV listing not confirmed
- No public proof of concept found
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- Unknown whether authentication is required for the duplicate action
Our recommendation
- Upgrade Payload packages to 3.90.0 or 4.0.0-canary.34 (keep all Payload packages on the same version); test first, as the release includes migration steps
- If patching is not possible immediately, apply the beforeDuplicate workaround to sensitive fields
- Identify internet-facing Payload instances with auth or user collections and prioritise them
- Review logs for unexpected duplicate requests on sensitive collections
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vc4h-q48j-5hcx github.com
- Fix commit 099ef12 github.com
- Payload release v3.90.0 github.com
- Payload security update for 3.x and 4.0 payloadcms.com
- GitLab Advisory Database advisories.gitlab.com
- OSV CVE-2026-105851 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:14.
Original description (NVD)
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.