{"action":"Upgrade @payloadcms/db-mongodb to 3.87.0 or later.","affected":[{"fixed":"3.87.0","introduced":"0"},{"fixed":"4.0.0-canary.20","introduced":"4.0.0-canary.0"}],"component":"@payloadcms/db-mongodb","cve_ids":["CVE-2026-106100"],"ecosystem":"npm","epss":0.00215,"exploited":false,"fixed_versions":["3.87.0","4.0.0-canary.20"],"ghsa_id":"GHSA-4ww4-68q3-h7g5","id":"tcs_01M5KF1SSMVMF0453MMHS3J3AV","modified_at":"2026-10-07T16:30:06.358044072Z","published_at":"2026-10-07T16:19:57Z","references":["https://osv.dev/vulnerability/GHSA-4ww4-68q3-h7g5","https://github.com/payloadcms/payload/security/advisories/GHSA-4ww4-68q3-h7g5","https://nvd.nist.gov/vuln/detail/CVE-2026-106100","https://github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941","https://github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935","https://github.com/payloadcms/payload","https://github.com/payloadcms/payload/releases/tag/v3.87.0"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-4ww4-68q3-h7g5","url":"https://osv.dev/vulnerability/GHSA-4ww4-68q3-h7g5"}],"summary":"Payload: Field-level write access bypass in Payload on MongoDB"}