Payload CMS access control lives in collection functions
Payload CMS access control lives in collection functions Payload CMS combines an admin panel, authentication-enabled collections, REST and GraphQL APIs, and configurable access functions. A default installation has a U
Payload CMS access control lives in collection functions
Payload CMS combines an admin panel, authentication-enabled collections, REST and GraphQL APIs, and configurable access functions. A default installation has a User collection with access to the admin panel. Additional collections can be public, authenticated, owner-scoped, or controlled by custom logic. The same product title can therefore front very different data boundaries.
What the measurement shows
On 2026-11-10 at 03:44:24 +08:00, title="Payload CMS" returned 99 assets with sub_type=all, page 1, and pagesize 1. The saved search is a title-level observation. The app="Payload CMS" probe returned zero, while a body-text probe returned more pages. Product names in documentation and generated pages make text search noisy.
The 99 title matches do not prove that an admin panel or API is exposed. Payload sites can have public front-end pages and a separate admin path. Confirm the route, deployment owner, and authentication before testing.
Default access and API keys
Payload documents default access control that secures data behind authentication. For collection operations, access functions can return a boolean or a query constraint. The admin access function controls entry to the admin panel; read, create, update, and delete control document operations. If readVersions is not configured, the collection's read access is used. A collection that supports authentication can also expose operations such as login, logout, refresh, and password recovery.
API keys are available for users in an authentication-enabled collection when configured. An API key is a durable machine credential. It needs its own owner, purpose, rotation, and revocation process. A key that is convenient for a build script may also be able to read draft content or update records if the collection's access functions do not distinguish the caller. Test the key against every operation the integration needs, not only the one endpoint in the original code.
Custom access is code
Access functions are application code. A condition that checks req.user proves authentication, not ownership. A condition that returns true for an administrator should also be paired with a review of which accounts can receive that role. A query constraint can accidentally expose records when a relationship field is missing or when an administrator overrides access. Write negative tests for anonymous users, ordinary users, and administrators.
The Local API can bypass HTTP-layer controls when overrideAccess is used. Server code must intentionally choose whether to run access checks. A background job that imports data may need elevated access, but the path should be isolated and logged. A webhook or server function that accepts a user-controlled collection name needs its own validation. Do not assume that a request reaching internal code is trusted.
Field and file boundaries
Collection access controls documents, while field-level access controls fields. A public collection may hide a password hash or internal note while exposing a title and image. Upload collections add file access and storage paths. A media URL that is public by design can bypass document-level checks. Review the storage adapter, public URL policy, and any image transformations.
The admin panel is not the only interface. REST and GraphQL can expose collections with different query shapes. GraphQL introspection may reveal schema even when documents are protected. Disable unused operations, rate-limit login, and review CORS and CSRF settings. Keep the application and its plugins current.
Exposure review
Start with the title set and reconcile it to known deployments. Identify the admin path, auth-enabled collections, API keys, public collections, upload storage, and plugins. Test anonymous and ordinary-user access to every sensitive operation. Review overrideAccess calls and any custom route that accepts collection names. Confirm that a revoked API key fails and that a password reset invalidates the intended sessions.
The count is small enough to investigate manually, but the lesson applies at any size: Payload's security is configuration and code, not a single product label. The review should read the access functions the application actually deploys.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.