CVE-2026-105855: Payload CMS Auth Bypass Vulnerability

CVE-2026-105855 Overview

CVE-2026-105855 is a broken access control vulnerability [CWE-284] in Payload, an open source headless content management system. The server fails to enforce the field-level access.update restriction on the password field of authentication collections. Authenticated users with update permissions on an auth collection can modify the password field even when access rules explicitly forbid it. The flaw affects Payload versions before 3.90.0 and canary builds before 4.0.0-canary.34.

Critical Impact
Authenticated attackers can overwrite the password of any user within an authentication collection they can update, enabling account takeover and privilege escalation.

Affected Products

Payload CMS versions prior to 3.90.0
Payload CMS canary versions prior to 4.0.0-canary.34
Applications using authentication collections with field-level access.update restrictions on the password field

Discovery Timeline

2026-10-06 - CVE CVE-2026-105855 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105855

Vulnerability Analysis

Payload authentication collections support field-level access control, allowing developers to define access.update functions that restrict which fields a user may modify. The update operation in packages/payload/src/collections/operations/utilities/update.ts extracted the password value from the incoming request payload before field-level access evaluation. Because the password was handled through a separate code path intended for credential rotation, the field-level access.update function configured for the password field was never invoked. The result is a broken access control condition [CWE-284] on an authentication-critical field.

Root Cause

The vulnerable code read const password = data?.password and processed the password change outside the standard field validation and access-check pipeline. Any configured access restriction on the password field was silently bypassed. The patch in commit 9de9e7911e29d60870a1d5480412524c63d6411e removes this out-of-band extraction so password updates flow through the same field-level access checks as every other field.

Attack Vector

An attacker needs valid credentials with update access to an authentication collection. The attacker sends an authenticated update request including a password property in the request body. The server applies the new password without running the field-level access.update function, overwriting the target user's credential. Subsequent login with the new password grants control of the targeted account.

typescript

// Patch excerpt from packages/payload/src/collections/operations/utilities/update.ts
   showHiddenFields,
   unpublishAllLocales: unpublishAllLocalesArg,
 }: SharedUpdateDocumentArgs<TSlug>): Promise<TransformCollectionWithSelect<TSlug, TSelect>> => {
-  const password = data?.password
   const publishAllLocales =
     !draftArg &&
     (publishAllLocalesArg ?? (hasLocalizeStatusEnabled(collectionConfig) ? false : true))
// Source: https://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e

The removed line is the out-of-band password extraction that bypassed field-level access checks. See the GitHub security advisory GHSA-fx49-4h83-wjv9 for additional context.

Detection Methods for CVE-2026-105855

Indicators of Compromise

Unexpected password properties in PATCH or PUT request bodies targeting authentication collection endpoints such as /api/users/:id.
Successful password changes in audit logs that do not correspond to a legitimate password-reset workflow.
Login events from new IP addresses or user agents immediately following an authenticated update request on the same account.

Detection Strategies

Review Payload application logs for update operations on authentication collections that include a password field submitted by non-admin principals.
Correlate successful authentications against prior update requests that modified the same user record within a short time window.
Instrument the update operation to log the acting user, target user, and whether data.password was present in the request.

Monitoring Recommendations

Forward Payload API access logs and authentication events to a centralized logging platform for correlation and retention.
Alert on any password change performed through the standard update endpoint rather than the dedicated reset or change-password flow.
Monitor for horizontal access patterns where one authenticated user updates records belonging to other users in an auth collection.

How to Mitigate CVE-2026-105855

Immediate Actions Required

Upgrade Payload to version 3.90.0 or later, or to canary 4.0.0-canary.34 or later.
Audit authentication collection records for unauthorized password changes since the vulnerable version was deployed.
Force a password reset for accounts in affected authentication collections if tampering cannot be ruled out.
Rotate active sessions and API tokens issued by affected collections.

Patch Information

The fix is included in Payload v3.90.0 and canary 4.0.0-canary.34. The remediation commit is 9de9e7911e29d60870a1d5480412524c63d6411e, which removes the pre-access-check password extraction so the field-level access.update function is enforced on the password field.

Workarounds

Restrict update access on authentication collections to administrators only until the upgrade is applied.
Add server-side middleware that rejects update requests containing a password property unless they originate from the password-change or reset flow.
Require re-authentication or multi-factor verification for any password change to limit the impact of account takeover attempts.

bash

# Upgrade Payload to a patched version
npm install payload@^3.90.0
# or for canary consumers
npm install payload@4.0.0-canary.34