Field afterRead hooks run even when field read access is denied
Maintainers usually reply within 1 day
@Arya125259 is already working on this.
Since Sep 27, 2026.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
- Domain
- authorization, backend
Research direction
Start in packages/payload/src/fields/hooks/afterRead/promise.ts, especially lines 131-140 and 282-404, and follow the ordering of field hooks, hidden-field handling, and access checks. Reproduce the issue with a field-level read denial and an afterRead logger, then verify the hook no longer runs for denied or hidden fields while accessible fields still behave normally.
Written by the indexing model from the issue text.
Description
Describe the Bug
Field afterRead hooks run before field-level access.read is checked. If access is denied, the hook's result is deleted right away, so expensive hooks (fetching, computing virtual fields) run for nothing.
- hooks: https://github.com/payloadcms/payload/blob/124b55a/packages/payload/src/fields/hooks/afterRead/promise.ts#L284
- access check + delete: https://github.com/payloadcms/payload/blob/124b55a/packages/payload/src/fields/hooks/afterRead/promise.ts#L375-L404
Same for hidden: true fields: the value is removed first (L131-L140), but the hook still runs, with value: undefined, unless showHiddenFields is set.
Expected: skip afterRead hooks for fields the user can't read.
Link to the code that reproduces this issue
Reproduction Steps
- Add a field with
access: { read: () => false }and anafterReadhook that logs - Read the doc without
overrideAccess - The hook logs, but the field is not in the response
Which area(s) are affected?
area: core
Environment Info
payload: 3.90.2 and main (4.0.0-canary.37)
- Dominant language
- TypeScript
- Stars
- 45.5k
- Forks
- 4.3k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 295
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from payloadcms/payload
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
payloadcms/payload#19060 ·
Maintainers usually reply within 1 day
-
WhereBuilder throws "Cannot read properties of undefined (reading 'value')" when the list URL filters on a field that is not filterablePossibly taken A pull request linked to this issue is open or already merged. OpenBug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
payloadcms/payload#19002 · 1 comment ·
Maintainers usually reply within 1 day
-
Regression: `findByID` with `disableErrors: true` throws `NotFound` for null/empty ids since 3.91.0Possibly taken @Krrishkumar125 claimed this 5 days ago. Openarea: core Bug invalid-reproduction status: needs-triage v3
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
payloadcms/payload#18935 · 1 comment ·
Maintainers usually reply within 1 day
-
bug: Local API call with req resets req.fallbackLocale to defaultLocalePossibly taken A pull request linked to this issue is open or already merged. Openarea: core Bug created-by: Contributor
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
payloadcms/payload#18768 ·
Maintainers usually reply within 1 day
-
[plugin-multi-tenant] Infinite redirect loop with custom tenantFieldName and isGlobal collectionsPossibly taken A pull request linked to this issue is open or already merged. OpenBug plugin: multi-tenant status: needs-triage v3
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
payloadcms/payload#18690 ·
Maintainers usually reply within 1 day
All issues in payloadcms/payload
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
galaxyproject/loom#616 ·
Maintainers usually reply within 1 day
-
e2e-failure ready-to-code
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
redhat-developer/rhdh-plugin-export-overlays#4580 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 1-3 hours Newbie friendliness 84/100
eknowledger/toolbench#266 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
devdotfast/whiteboard#1415 · 1 comment ·
Maintainers usually reply within 1 day