Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-106100

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 11.1%
CVSS Severity
CVSS v3 Score 7.1
Products affected by CVE-2026-106100


Contact Us

Shodan ® - All rights reserved