Payload CMS access control lives in collection functions

Payload CMS integrates access control within collection functions. It offers collections with various access types like public, authenticated, owner-scoped, or customized logic. A default installation includes a User collection with access to the admin panel. The same collection can have different access boundaries.

Payload measures showed 99 assets were found on 2026-11-10 at 03:44:24 +08:00. A title-level saved search confirmed this. API routes and deployment details must be verified before testing default access control. Access functions can return booleans or query constraints for collection operations.

API keys are provided for authenticated collections. These credentials need their own owner, purpose, rotation, and revocation process. Custom access functions are application code that checks for user authentication and administrator roles. Queries may accidentally expose records if conditions are not carefully written.

Local API can bypass standard controls when overrideAccess is used. Server code must choose to run access checks intentionally. Background jobs requiring elevated access should be isolated and logged. Webhooks or server functions accepting user-controlled collection names need validation.

Access controls apply to documents, fields, and files. A public collection might hide sensitive data while exposing others. Storage paths and image transformations should be reviewed. The admin panel isn't the only entry point; REST and GraphQL can expose collections differently.

To review security, start with the configured access and compare it to deployed instances. Check admin paths, auth-enabled collections, API keys, public collections, storage, and plugins. Test anonymous and ordinary-user access to sensitive operations, and review overrideAccess and custom routes. Ensure revoked API keys fail and password resets invalidate sessions.