The issue arises when the duplicate operation in PayloadCMS copies data from a source document even if the target fields are hidden or if the caller’s access.read or access.create rules reject that data. This bypass of intended access controls allows a user to retrieve content that should remain private, constituting an unintended disclosure of protected information. The weakness is an improper access control (CWE-284) combined with a failure to verify the caller’s permissions (CWE-863).

PayloadCMS (payload) versions from 3.0.0 up to and including 3.89.99 and any canary releases prior to 4.0.0-canary.34 are vulnerable. The problem was addressed in the 3.90.0 release and the 4.0.0-canary.34 release.

The CVSS score of 9.3 signals a high severity vulnerability. An attacker who can invoke the duplicate operation would be able to obtain hidden or restricted data. While the CVE description does not explicitly state the authentication requirements or exact API endpoint, the duplicate function is generally accessed via a remote API call. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Consequently, exploitable risk remains significant for systems that expose the duplicate operation without adequate authorization checks.