cveboard RSS feed

CVE-2026-105851

GitHubCritical, npm

Payload: Field access control bypass on auth collections

Payload's duplicate operation copies field values from the source document even when a field is hidden, or its access.read or access.create rule would reject the value for that caller.

No known exploitation
Severity
Critical, CVSS 9.3 (v4.0)
EPSS
0.25% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages