Payload is a free and open source headless content management system.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 6, 2026 · NIST NVD

   Detected

   Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.

2. Oct 15, 2026 · NIST NVD

   Updated

   Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.

Affected

• cpe payloadcms/payloadversion unspecified
• cpe payloadcms/payload4.0.0

Sources

• CVE.orgVulnerability recordCVE-2026-106100

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-106100

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-106100

  Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not perm

  nvd.nist.gov

References

• Patch · github.com
• Patch · github.com
• Release Notes · github.com
• Vendor Advisory · github.com