https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-09T04:32:22.686876+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-106100 CVE-2026-106100 — Payload: Field-level write access bypass in Payload on MongoDB 2026-10-09T04:32:22.689883+00:00

Affected: payloadcms payload

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.