payloadcms / payloadcms/payload

Collection list does not prevent user from deleting items, even though access control does

Open
#12,362 4 comments 2 reactions 1 assignee View on GitHub

@DanRibbens is already working on this.

Since May 12, 2025.

Dominant language
TypeScript
Stars
44.8k
Forks
4.2k
Avg merge
2d 21h
Merged PRs (30d)
53

Description

Describe the Bug

Currently I have a localised website. We have a few editor roles for local markets, each of which has a few locales that they can edit and can't edit others.

For our collections, we have access controls set up in a way that should prevent users to delete/create/update locales that are not assigned to the role.

Now, probably because of the way locales are saved in payload (which is very unintuitive), an interesting phenomenon occurs with this setup: regardless of the access control rules, the user is able to delete the collection item when deleting from the list view, but is not able to delete (even his own assigned locale) from within the document edit view.

Link to the code that reproduces this issue

https://github.com/iamlinkus/payload-access-control-localization-bug

Reproduction Steps
  1. Clone repro repo.
  2. Create a user and assign it a locale role.
  3. Switch to the locale that the user has assigned.
  4. Create a post in the posts collection.
  5. Try to delete the document from inside the document edit view -->>> Error.
  6. Go back to list view without changing the locale, select the item in the list and click delete -->>> Success
Which area(s) are affected? (Select all that apply)

area: core, area: ui

Environment Info
Binaries:
  Node: 23.3.0
  npm: 10.9.0
  Yarn: N/A
  pnpm: 9.12.3
Relevant Packages:
  payload: 3.33.0
  next: 15.3.0
  @payloadcms/db-mongodb: 3.33.0
  @payloadcms/email-nodemailer: 3.33.0
  @payloadcms/graphql: 3.33.0
  @payloadcms/next/utilities: 3.33.0
  @payloadcms/payload-cloud: 3.33.0
  @payloadcms/richtext-lexical: 3.33.0
  @payloadcms/translations: 3.33.0
  @payloadcms/ui/shared: 3.33.0
  react: 19.1.0
  react-dom: 19.1.0
Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 24.4.0: Fri Apr 11 18:32:50 PDT 2025; root:xnu-11417.101.15~117/RELEASE_ARM64_T6041
  Available memory (MB): 49152
  Available CPU cores: 14

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.