Payload: Unauthorized update to collection documents

Description

An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control.

You are affected if:

• You are configuring orderable: true with any collection or join field.

Recommendation

Update the payload package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34

  < 3.90.0**

• Patched version(s): **4.0.0-canary.34

  3.90.0**

References

• GHSA-f7hx-52q9-hcrf
• CVE-2026-105859
• CWE-639
• CWE-862
• CAPEC-310