Summary
Payload CMS can expose information from related documents when a user queries a readable collection whose relationship points to documents protected by access.read constraints. The issue becomes risky when relationship resolution does not consistently enforce the related collection's authorization rules.
Payload CMS can expose information from related documents when a user queries a readable collection whose relationship points to documents protected by access.read constraints. The issue becomes risky when relationship resolution does not consistently enforce the related collection's authorization rules.
Affected context
The vulnerability occurs in Payload CMS deployments where:
- A collection is readable by the requesting user
- That collection contains a relationship to another collection
- The related collection relies on
access.readconstraints - Relationship queries or response expansion do not reapply those constraints consistently
Exposure depends on collection configuration, relationship behavior, and the sensitivity of the related documents.
The vulnerability occurs in Payload CMS deployments where:
- A collection is readable by the requesting user
- That collection contains a relationship to another collection
- The related collection relies on
access.readconstraints - Relationship queries or response expansion do not reapply those constraints consistently
Exposure depends on collection configuration, relationship behavior, and the sensitivity of the related documents.
Exploit preconditions
- Attack surface: Collection query and relationship-resolution endpoints
- Required access: A user or client able to query a readable collection
- Trigger point: Requesting records that include relationships to protected documents
- Why exploitation is possible: Authorization checks for the related collection may be omitted or insufficient during relationship traversal
- Attack surface: Collection query and relationship-resolution endpoints
- Required access: A user or client able to query a readable collection
- Trigger point: Requesting records that include relationships to protected documents
- Why exploitation is possible: Authorization checks for the related collection may be omitted or insufficient during relationship traversal
Why this happens
The underlying bug is an authorization enforcement gap in relationship queries. Although the related collection defines access.read constraints, the application may treat access to the parent collection as sufficient and expose related document data without independently evaluating the related collection's authorization policy.
This maps to CWE-862: Missing Authorization, where a protected operation or resource lacks a required permission check.
The underlying bug is an authorization enforcement gap in relationship queries. Although the related collection defines access.read constraints, the application may treat access to the parent collection as sufficient and expose related document data without independently evaluating the related collection's authorization policy.
This maps to CWE-862: Missing Authorization, where a protected operation or resource lacks a required permission check.
Potential impact
- Unauthorized users may view fields from protected related documents
- Sensitive business, customer, or operational information could be disclosed
- Relationship metadata may reveal the existence or structure of restricted records
- Exposed information could support further account, privacy, or business-logic attacks
- Unauthorized users may view fields from protected related documents
- Sensitive business, customer, or operational information could be disclosed
- Relationship metadata may reveal the existence or structure of restricted records
- Exposed information could support further account, privacy, or business-logic attacks
General mitigation guidance
Mitigation generally focuses on enforcing authorization at every resource boundary, including relationship resolution.
Common defensive patterns include:
- Evaluating the related collection's read policy independently for every returned document
- Applying field-level filtering and minimizing relationship data by default
- Using explicit allowlists for relationship expansion and population
- Treating client-controlled query parameters as untrusted input
- Returning only the minimum data necessary for the requesting operation
- Testing authorization decisions with users of different roles and tenant scopes
- Applying least privilege to collection and relationship access policies
Mitigation generally focuses on enforcing authorization at every resource boundary, including relationship resolution.
Common defensive patterns include:
- Evaluating the related collection's read policy independently for every returned document
- Applying field-level filtering and minimizing relationship data by default
- Using explicit allowlists for relationship expansion and population
- Treating client-controlled query parameters as untrusted input
- Returning only the minimum data necessary for the requesting operation
- Testing authorization decisions with users of different roles and tenant scopes
- Applying least privilege to collection and relationship access policies
How teams detect issues like this
Organizations can look for this issue through:
- Static and semantic analysis of relationship resolvers for missing authorization calls
- Code review checks verifying that nested resources invoke their own read policies
- API tests using readable parent collections linked to restricted child collections
- Policy tests for tenant boundaries, roles, and field-level visibility
- Runtime monitoring for unusual relationship expansion or repeated access to restricted records
- Automated security review tools that identify authorization checks missing from nested data paths
Organizations can look for this issue through:
- Static and semantic analysis of relationship resolvers for missing authorization calls
- Code review checks verifying that nested resources invoke their own read policies
- API tests using readable parent collections linked to restricted child collections
- Policy tests for tenant boundaries, roles, and field-level visibility
- Runtime monitoring for unusual relationship expansion or repeated access to restricted records
- Automated security review tools that identify authorization checks missing from nested data paths
