{"vulnerability": "CVE-2026-105851", "sightings": [{"uuid": "5d26b006-b8ca-460e-a70e-fa13b8d247f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105851", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx7zla7z2n24", "content": "\ud83d\udea8 CVE-2026-105851 \u2014 CVSS 9.3 CRITICAL\n\nPayload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105851\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-06T18:08:23.865646Z"}, {"uuid": "6ef5b373-98ac-44ba-893f-92bda687a90f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105851", "type": "seen", "source": "https://gist.github.com/alon710/e04d756121a8845804f834a1f9badce0", "content": "# CVE-2026-105851: CVE-2026-105851: Privilege Escalation via Field Access Control Bypass in Payload CMS Duplication Mechanism\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105851\n\n## Summary\nA critical access control bypass vulnerability (CVE-2026-105851) in Payload CMS allows authenticated users to bypass field-level access controls during document duplication. By duplicating high-privilege documents, such as administrator accounts, standard users can inherit sensitive fields (e.g., role configurations or API keys), leading to privilege escalation.\n\n## TL;DR\nPayload CMS failed to enforce field-level access controls and the disableDuplicate configuration during document duplication, allowing standard users to duplicate administrator profiles and escalate their privileges.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284 / CWE-863\n- **Attack Vector**: Network (Unauthenticated or Low-Privileged Local Network/API Access)\n- **CVSS v4.0**: 9.3 (Critical)\n- **EPSS Score**: Not Available\n- **Impact**: Privilege Escalation / Unauthorized Data Access\n- **Exploit Status**: Conceptual / Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Payload CMS\n- **payload**: >= 3.0.0, < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade Payload CMS to version 3.90.0 or higher (for 3.x installations) or 4.0.0-canary.34 or higher (for 4.x installations).\n- Explicitly set disableDuplicate: true in all authentication-enabled and high-privilege collection configurations.\n- Implement custom beforeChange or beforeValidate hooks to strip sensitive fields during duplication operations programmatically.\n\n**Remediation Steps:**\n1. Analyze the active Payload CMS version in package.json.\n2. Run npm install payload@3.90.0 or npm install payload@4.0.0-canary.34 depending on the track.\n3. Audit all collection configurations and append disableDuplicate: true to users and administrative schemas.\n4. Rebuild the application and deploy the patch to staging and production systems.\n5. Verify that POST requests to /api/users/:id/duplicate return a 400 or 404 response status.\n\n## References\n\n- [GitHub Security Advisory GHSA-vc4h-q48j-5hcx](https://github.com/payloadcms/payload/security/advisories/GHSA-vc4h-q48j-5hcx)\n- [Payload CMS Commit 099ef12e26](https://github.com/payloadcms/payload/commit/099ef12e2682f076aa8e8d0ccb790536b4e1027f)\n- [Payload CMS v3.90.0 Release Notes](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n- [CVE-2026-105851 Record](https://www.cve.org/CVERecord?id=CVE-2026-105851)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105851) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T00:30:30.000000Z"}]}