CVE-2026-105859
Payload: Unauthorized update to collection documents
An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control.
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1)
- EPSS
- 0.35% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- payload (npm) < 3.90.0, fixed in 3.90.0 · GHSA-f7hx-52q9-hcrf
- payload (npm) >= 4.0.0-canary.0, < 4.0.0-canary.34, fixed in 4.0.0-canary.34 · GHSA-f7hx-52q9-hcrf