Description
Payload’s duplicate operation copies field values from the source document even when a field is hidden, or its access.read or access.create rule would reject the value for that caller.
The disableDuplicate collection setting, enabled by default on auth collections, did not stop this.
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
Affected version(s): **> 4.0.0-canary.0, < 4.0.0-canary.34 > 3.0.0, < 3.90.0** Patched version(s): **4.0.0-canary.34 3.90.0**
References
Could your website be exposed too?
SmartScanner can check your website for Payload: Field access control bypass on auth collections and gives you actionable findings to investigate.
Start a free scanRelated Issues
- payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) - CVE-2026-25574
- Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass - CVE-2026-45577
- Payload: Sort queries could expose protected field information - CVE-2026-105805
- LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header - CVE-2026-39411
You might also like:
See something that needs correcting? Let us knowUpdated October 06, 2026