Summary
Payload's duplicate operation may copy values from a source document even when those values are hidden or rejected by the caller's field-level read or create access rules. An attacker who can invoke duplication in an affected configuration could obtain or propagate data that the caller is not authorized to access or create.
Payload's duplicate operation may copy values from a source document even when those values are hidden or rejected by the caller's field-level read or create access rules. An attacker who can invoke duplication in an affected configuration could obtain or propagate data that the caller is not authorized to access or create.
Affected context
The issue occurs in Payload deployments using the document duplicate operation when field visibility or access rules restrict the source value for the requesting user. The configured disableDuplicate option may not provide protection because the access-control check can be bypassed during duplication. The affected behavior applies to versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34.
The issue occurs in Payload deployments using the document duplicate operation when field visibility or access rules restrict the source value for the requesting user. The configured disableDuplicate option may not provide protection because the access-control check can be bypassed during duplication. The affected behavior applies to versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34.
Exploit preconditions
- Attack surface: The Payload document duplication functionality
- Required access: An authenticated or otherwise authorized ability to invoke duplication, depending on application configuration
- Trigger point: A duplicate request involving a source document with hidden or access-restricted fields
- Why exploitation is possible: The operation copies source values without consistently enforcing the caller's field-level read and create authorization decisions
- Attack surface: The Payload document duplication functionality
- Required access: An authenticated or otherwise authorized ability to invoke duplication, depending on application configuration
- Trigger point: A duplicate request involving a source document with hidden or access-restricted fields
- Why exploitation is possible: The operation copies source values without consistently enforcing the caller's field-level read and create authorization decisions
Why this happens
The underlying flaw is an authorization enforcement gap in a document-copy workflow. Duplication treats source values as available for copying even when field-level access rules deny reading those values or deny creating them for the caller. This behavior maps primarily to CWE-284: Improper Access Control and is also consistent with CWE-863: Incorrect Authorization, because the operation does not reliably apply the permissions associated with the requesting principal.
The underlying flaw is an authorization enforcement gap in a document-copy workflow. Duplication treats source values as available for copying even when field-level access rules deny reading those values or deny creating them for the caller. This behavior maps primarily to CWE-284: Improper Access Control and is also consistent with CWE-863: Incorrect Authorization, because the operation does not reliably apply the permissions associated with the requesting principal.
Potential impact
- Sensitive field values may be disclosed to an unauthorized user
- Restricted data may be copied into a document the caller can access
- Application data integrity may be reduced through unauthorized field creation or modification
- Downstream workflows may process or expose values that bypassed intended authorization controls
- Sensitive field values may be disclosed to an unauthorized user
- Restricted data may be copied into a document the caller can access
- Application data integrity may be reduced through unauthorized field creation or modification
- Downstream workflows may process or expose values that bypassed intended authorization controls
General mitigation guidance
Mitigation generally focuses on enforcing authorization consistently across every document operation and treating duplication as a new read-and-create authorization decision.
Common defensive patterns include:
- Re-evaluating source-field read permissions before exposing or copying each value
- Applying destination-field create permissions during duplication
- Denying duplication by default for sensitive document types or fields
- Treating administrative convenience settings such as duplicate controls as defense-in-depth rather than authorization boundaries
- Returning only explicitly authorized fields and preserving least-privilege access throughout the operation
- Adding regression tests for hidden fields, denied read rules, denied create rules, and mixed-permission documents
Mitigation generally focuses on enforcing authorization consistently across every document operation and treating duplication as a new read-and-create authorization decision.
Common defensive patterns include:
- Re-evaluating source-field read permissions before exposing or copying each value
- Applying destination-field create permissions during duplication
- Denying duplication by default for sensitive document types or fields
- Treating administrative convenience settings such as duplicate controls as defense-in-depth rather than authorization boundaries
- Returning only explicitly authorized fields and preserving least-privilege access throughout the operation
- Adding regression tests for hidden fields, denied read rules, denied create rules, and mixed-permission documents
How teams detect issues like this
Organizations can identify similar authorization gaps through:
- Static analysis and code review of duplicate, clone, import, export, and bulk-copy paths
- Review signals showing direct source-document field copying before per-field authorization checks
- Tests that exercise duplication with conflicting read and create permissions
- Runtime audit logging for duplicate operations, including actor, source document, destination document, and copied fields
- Policy enforcement requiring authorization checks at both source-read and destination-write boundaries
- Automated security testing or code-review tools that model role and field-level access decisions
Organizations can identify similar authorization gaps through:
- Static analysis and code review of duplicate, clone, import, export, and bulk-copy paths
- Review signals showing direct source-document field copying before per-field authorization checks
- Tests that exercise duplication with conflicting read and create permissions
- Runtime audit logging for duplicate operations, including actor, source document, destination document, and copied fields
- Policy enforcement requiring authorization checks at both source-read and destination-write boundaries
- Automated security testing or code-review tools that model role and field-level access decisions
