# CVE-2026-106100: Payload MongoDB adapter field-level access control bypass

Source: https://junglewise.ai/threats/cve-2026-106100-payload-is-a-free-and-open-source-headless-content-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106100 · Severity: high · CVSS 7.1 · Published 2026-10-06

Payload is a headless content management system that allows organizations to manage and deliver content through APIs. In the MongoDB adapter, authenticated users with document update permissions can modify fields that should be protected by field-level write access controls, circumventing intended security restrictions. This could allow unauthorized modification of sensitive data like permissions, pricing, or other restricted fields.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Payload](https://junglewise.ai/threats/vendors/payload).

## Quick answers

**Is CVE-2026-106100 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106100 being exploited in the wild.

**How severe is CVE-2026-106100?** High severity, with a CVSS score of 7.1, published 6 October 2026.

**Which products and versions are affected?** @payloadcms/db-mongodb (npm) SEMVER:introduced=0,fixed=3.87.0; Payload @Payloadcms/Db-Mongodb before 3.87.0 and canary versions before 4.0.0-canary.20.

**Is there a fix for CVE-2026-106100?** Yes. @payloadcms/db-mongodb (npm): upgrade to 3.87.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106100 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106100?** Check whether you run @payloadcms/db-mongodb (npm) or Payload @Payloadcms/Db-Mongodb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @payloadcms/db-mongodb (npm): upgrade to 3.87.0 or later

  ```sh
  npm install @payloadcms/db-mongodb@3.87.0
  ```


## Technical details

An authenticated attacker who has permission to update a document can bypass field-level write access controls in the MongoDB adapter by modifying protected fields during document updates. The PostgreSQL and SQLite adapters are not affected, suggesting the vulnerability is specific to MongoDB's handling of array and block field validation. The fix involves filtering null rows from array and block fields during the beforeValidate hook to properly enforce access control policies.

## Affected products

- Payload @payloadcms/db-mongodb before 3.87.0 and canary versions before 4.0.0-canary.20

## Identifiers

- CVE-2026-106100
- GHSA-4ww4-68q3-h7g5

## Timeline

- 2026-10-06: disclosed

## References

- [https://github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941](https://github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941)
- [https://github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935](https://github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935)