CVE-2026-105851: Payload CMS Auth Bypass Vulnerability

CVE-2026-105851 Overview

Payload is a free and open source headless content management system (CMS) written in TypeScript. CVE-2026-105851 is a broken access control vulnerability (CWE-284) in the collection duplicate operation. The flaw affects versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34. When a user duplicates a document, Payload copies values from the source even when a field is hidden or when access.read or access.create rules reject that value for the caller. The disableDuplicate setting does not prevent this bypass. Fixed releases are 3.90.0 and 4.0.0-canary.34.

Critical Impact
Any caller permitted to duplicate a document can obtain field values they are not authorized to read, and can create documents with field values they are not authorized to set, undermining per-field access control across collections.

Affected Products

Payload CMS versions 3.0.0 through 3.89.x
Payload CMS canary versions prior to 4.0.0-canary.34
Collections using field-level access.read or access.create rules, or hidden fields

Discovery Timeline

2026-10-06 - CVE CVE-2026-105851 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105851

Vulnerability Analysis

Payload exposes a duplicate operation that creates a new document seeded from an existing one. The operation reads the source document and passes its field values into the create pipeline for the new document. The duplication path does not re-evaluate field-level access control for the caller. As a result, hidden fields and fields guarded by access.read or access.create rules are copied verbatim into the new document.

The practical impact is twofold. First, a caller who cannot read a protected field can trigger duplicate and then view the resulting document to extract the value. Second, a caller who cannot create a given field value can plant that value in a new document through duplication. The disableDuplicate collection setting was intended as a safety switch, but it does not stop the underlying access-control gap on fields when duplicate is otherwise reachable.

Root Cause

The duplicate operation handler bypassed per-field access checks that are enforced on normal read and create operations. Field-level access.read, access.create, and hidden configurations were not applied when values flowed from the source document into the new document.

Attack Vector

The vulnerability is reachable over the network through the authenticated REST or Local API duplicate endpoint. An authorized but low-privilege user issues a POST to /api/{collection}/:id/duplicate. The server returns, or persists, field values the caller should not see or set.

typescript

// Patch excerpt: packages/payload/src/collections/endpoints/index.ts
// Registers an explicit duplicate endpoint so access control is enforced.
import { updateHandler } from './update.js'
import { updateByIDHandler } from './updateByID.js'

export const duplicateEndpoint: Endpoint = {
  handler: duplicateHandler,
  method: 'post',
  path: '/:id/duplicate',
}

export const defaultCollectionEndpoints: Endpoint[] = [
  ...wrapInternalEndpoints([
    // ...
  ]),
]
// Source: https://github.com/payloadcms/payload/commit/099ef12e2682f076aa8e8d0ccb790536b4e1027f

Detection Methods for CVE-2026-105851

Indicators of Compromise

POST requests to /api/{collection}/:id/duplicate originating from accounts that do not hold read or create rights on sensitive fields in that collection.
Newly created documents whose protected field values match those of a source document owned by a different user or tenant.
Spikes in duplicate operations against collections containing credentials, PII, or billing fields.

Detection Strategies

Review Payload server logs for POST /:id/duplicate calls and correlate caller identity against the field-level access configuration of the targeted collection.
Diff newly created documents against their source documents to flag copies of fields marked hidden or restricted by access.read / access.create.
Inventory running Payload instances and compare installed versions against 3.90.0 and 4.0.0-canary.34 to identify vulnerable deployments.

Monitoring Recommendations

Enable application-level audit logging for the duplicate endpoint, capturing user ID, source document ID, and resulting document ID.
Alert on duplicate operations performed by non-admin roles against collections flagged as sensitive.
Forward Payload API logs to a central analytics pipeline to retain history for retrospective hunts once the patch is applied.

How to Mitigate CVE-2026-105851

Immediate Actions Required

Upgrade Payload to 3.90.0 or 4.0.0-canary.34 across all environments.
Audit documents created via duplicate since deployment of any affected version and remediate records that leak protected field values.
Rotate secrets, tokens, or credentials stored in Payload fields that were reachable through the duplicate operation.

Patch Information

The fix is delivered in Payload 3.90.0 and 4.0.0-canary.34. The patch registers an explicit duplicateEndpoint and enforces collection and field-level access control during duplication. See the GitHub Security Advisory GHSA-vc4h-q48j-5hcx, the commit 099ef12, and the Payload v3.90.0 release notes.

Workarounds

Restrict the duplicate operation at the collection level by setting access.create to deny non-privileged roles until the patch is applied.
Remove or gate the duplicate UI control in the admin panel for roles that should not create new documents.
Place an API gateway or reverse proxy rule that blocks POST requests matching the pattern /api/*/*/duplicate for untrusted roles.

bash

# Example nginx rule to block the duplicate endpoint pending upgrade
location ~ ^/api/[^/]+/[^/]+/duplicate$ {
    if ($request_method = POST) {
        return 403;
    }
}