Globals: GET /api/globals/<slug>/versions returns 500 (TypeError in drizzle adapter) when versions are not enabled — findVersions has no guard

Open
#18,056 1 comment 0 reactions 1 assignee View on GitHub

@r1tsuu is already working on this.

Since Sep 11, 2026.

Assessment

This issue has not been assessed yet.

Description

area: core Bug db-postgres
Describe the Bug

GET /api/globals/<slug>/versions on a global that does not have versions enabled returns HTTP 500 (TypeError: Cannot read properties of undefined (reading 'id')) instead of a clean 4xx.

The global findVersions operation has no guard on globalConfig.versions being disabled: payload/src/globals/operations/findVersions.ts runs access + query validation and then calls payload.db.findGlobalVersions unconditionally.

In the drizzle adapter, findGlobalVersions resolves the table via this.tableNameMap.get(_${toSnakeCase(globalConfig.slug)}${this.versionsSuffix}). For a global without versions that map entry does not exist, so tableName is undefined, findMany then dereferences a non-existent table, and the request dies with TypeError: Cannot read properties of undefined (reading 'id') → HTTP 500.

Observed in production (Sentry) on Payload 3.88.0 with @payloadcms/db-postgres; reproduced for every global in the config that has versions disabled (both versions: false explicitly and versions simply omitted). Unauthenticated callers get a 403 first, so this needs an authenticated user — but any authenticated poke at a documented REST route should not be able to produce a 500/TypeError.

Expected: a 4xx (e.g. 404 like an unknown route, or 400 "versions are not enabled for this global"), or an empty paginated result — anything intentional rather than an adapter TypeError.

Link to the code that reproduces this issue

https://github.com/payloadcms/payload/blob/v3.88.0/packages/drizzle/src/findGlobalVersions.ts (no repro repo needed — any project with one non-versioned global reproduces it, see steps)

Reproduction Steps
  1. Create a project with any global without versions (e.g. the default from create-payload-app — or add versions: false explicitly; both reproduce) using @payloadcms/db-postgres.
  2. Log in as an authenticated user (so readVersions access passes).
  3. GET /api/globals/<that-global-slug>/versions
  4. → HTTP 500, server logs TypeError: Cannot read properties of undefined (reading 'id') from the drizzle adapter's findMany.

The collection analogue of this guard exists for other invalid-route cases; the global versions operation just never checks globalConfig.versions before hitting the adapter.

Which area(s) are affected?

area: core, db-postgres

Environment Info

Payload 3.88.0
@payloadcms/db-postgres 3.88.0
Next.js 16.3.3
Node.js 24 (LTS)
PostgreSQL 16

Dominant language
TypeScript
Stars
44.8k
Forks
4.2k
Avg merge
2d 21h
Merged PRs (30d)
53

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from payloadcms/payload

All issues in payloadcms/payload

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.