{"id":"CVE-2026-105859","published":"2026-10-06T17:17:21.987","lastModified":"2026-10-06T20:03:40.690","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-639","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409","tags":[]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","tags":[]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf","tags":[]}],"exploitRefs":[{"url":"https://github.com/payloadcms/payload/commit/36fa9af73dd04fa59f4b4a06d11454538c4c1409","tags":[]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","tags":[]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-f7hx-52q9-hcrf","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to modify collection documents in a headless content management system without proper access control, leading to unauthorized data changes.","exploitability":"Exploitation is relatively straightforward if an attacker can submit a request to the specific update endpoint, requiring access to the system and knowledge of the endpoint.","blast_radius":"If exploited, this could lead to significant data breaches and unauthorized modifications, impacting the integrity and confidentiality of the system's content.","remediation":"Upgrade to version 3.90.0 or 4.0.0-canary.34 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","auth-bypass","data-modification"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:43:13.785Z"}}