Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M
CVE-2026-105855Payload: Field-level password update restrictions were not enforced
High 7.6
In plain English
A high-severity improper access control in payload from payloadcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | payload | 3.90.0 | GHSA-fx49-4h83-wjv9 |
| npm | payload | 4.0.0-canary.34 | GHSA-fx49-4h83-wjv9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| payloadcms | payload | < 3.90.0>= 4.0.0-canary.0, < 4.0.0-canary.34 |
Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N