Description
A readable collection could expose information about protected documents in a related collection.
You are affected if:
- You expose a readable collection with a relationship to a collection protected by access.read where constraints.
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34 < 3.90.0** Patched version(s): **4.0.0-canary.34 3.90.0**
References
Could your website be exposed too?
SmartScanner can check your website for Payload relationship-query authorization bypass and gives you actionable findings to investigate.
Start a free scanRelated Issues
- OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex - CVE-2026-30956
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/expo - CVE-2026-42349
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/hono - CVE-2026-42349
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/nextjs - CVE-2026-42349
You might also like:
See something that needs correcting? Let us knowUpdated October 06, 2026