Skip to content

Product

payloadcms @payloadcms/db-mongodb vulnerabilities

1 published CVE affecting payloadcms @payloadcms/db-mongodb, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
0
High
1
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest payloadcms @payloadcms/db-mongodb CVEs

Newest publication first

  1. CVE-2026-106100 Payload: Field-level write access bypass in Payload on MongoDB

    Published
    HighCVSS 7.1 EPSS 0.22%

    Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not perm...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.