CVE-2026-105851 is a High severity access control flaw in Payload, the headless CMS. From 3.0.0 before 3.90.0, the duplicate operation copies field values from a source document even when a field is hidden or its access rules would reject the value for the caller. Upgrade to 3.90.0, or 4.0.0-canary.34 on canary.
What's affected
- Package: payload (npm).
- Affected: 3.0.0 before 3.90.0 (the advisory says greater than 3.0.0), and 4.0.0-canary.0 before 4.0.0-canary.34.
- Fixed: 3.90.0 and 4.0.0-canary.34.
- Condition: collections where duplicate is available and fields rely on hidden settings or access.read or access.create rules.
- Note: the disableDuplicate collection setting, on by default for auth collections, did not stop this, per the advisory.
The record scores this 8.1 under CVSS 3.1 and calls it High. The project's GitHub advisory rates it Critical, with a CVSS v4 score of 9.3. The title here follows the record, and both ratings are listed. If your authentication collections hold sensitive fields, treat it with the higher urgency.
How to check if you're exposed
Payload is an npm package, so read the installed version in each project and environment.
npm ls payload
pnpm why payload
grep -n "payload" package.json
Check every deployment target too: production, staging, preview builds and any container image built from an older commit. Then look at the packages next to Payload, because this release series also touches plugins and database adapters:
npm ls @payloadcms/plugin-ecommerce @payloadcms/plugin-multi-tenant
npm ls @payloadcms/db-postgres @payloadcms/db-sqlite @payloadcms/db-vercel-postgres @payloadcms/db-d1-sqlite
Then look at where field level access matters in your configuration.
grep -rn "access:" src/collections/ | grep -i "read\|create"
grep -rn "hidden: true" src/
List fields that use hidden or read and create access rules to protect values, such as roles, tokens, internal notes and API key fields. Authentication collections deserve the closest look, since the advisory says duplicate was covered by a default setting that failed here.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.
What to do now
- Upgrade all Payload packages together to 3.90.0 or later on the 3.x line, or to 4.0.0-canary.34 or later on the canary line, and keep versions in step across packages.
- As the advisory's workaround, add a beforeDuplicate field hook to sensitive fields and set the value to empty or to your default.
- Review who is allowed to run duplicate on each collection, and restrict it where it is not needed.
- Check recently duplicated documents for values that should not have been copied.
- Read the v3.90.0 release notes for behavior and API changes that may need code updates, and run your test suite before deploying.
- Redeploy every environment, including preview and staging, and rebuild container images.
- Re-scan your lockfile after the change to confirm no older copy of the package remains.
Why it matters
The record lists CWE-284, improper access control, and CWE-863, incorrect authorization. Field access rules are a promise: a value the caller may not read or write should never travel through the system for that caller. The duplicate operation broke the promise by copying the source value anyway.
Why it can be serious is in how the copy behaves. Duplicating a document the caller can see gives them a new document containing fields they should not have, which they may then read. On auth collections, the copied fields can include credentials or role data. The advisory's metrics show high integrity impact and a high impact on connected systems.
The record does not list this CVE as exploited in the wild. It shows why access control needs to sit at the data layer and not only in each operation. Payload's release notes for v3.90.0 describe a set of critical security fixes and recommend upgrading even if none of the listed items affect you. They also say exploit details and severity are intentionally left out of the notes, so read each advisory for the conditions.
Quick check
Does disableDuplicate protect me?
No. The advisory says the setting, enabled by default on auth collections, did not prevent this behavior.
What if I cannot upgrade yet?
The advisory suggests a beforeDuplicate field hook that sets sensitive fields to empty or a default value.
Sources
Last reviewed: 18 October 2026.
