Description

Payload: Unauthorized update to collection documents

Impact

An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control.

You are affected if:

You are configuring orderable: true with any collection or join field.

Patches

In the patched version access control is properly enforced.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Mitigation

Aliases

References