Payload CMS: Missing authorization allows unauthorized document updates

Summary

Payload is a headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a request to a specific update endpoint can modify collection documents without enforcing collection or field-level access control. The flaw applies only when orderable is enabled on a collection or join field. The CVSS score is 9.8 (critical), and no authentication or user interaction is required.

Affected

• Payload 3.x before 3.90.0 (from 3.32.0, where orderable is configured)
• Payload 4.0 canary builds from 4.0.0-canary.0 before 4.0.0-canary.34

Fixed in

• Payload 3.90.0
• Payload 4.0.0-canary.34

Workaround

Unknown.

Exploitation

• No known exploitation; not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• No public proof of concept found.

Our recommendation

• Check whether any collection or join field uses orderable: true.
• Upgrade to Payload 3.90.0 or later 3.x release, or 4.0.0-canary.34 or later.
• Review update logs for unexpected document changes.
• If patching is not possible immediately, restrict network access to the Payload API and admin interface.
• Verify exposure in your own configuration and installed versions.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-f7hx-52q9-hcrf github.com
• Payload v3.90.0 release github.com
• Fix commit 36fa9af github.com
• OSV GHSA-f7hx-52q9-hcrf osv.dev
• Payload security update announcement payloadcms.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:05.