~ / search / GHSA-fx49-4h83-wjv9

GHSA-fx49-4h83-wjv9

Payload didn't enforce field-level password update restrictions

Source: GitHub Advisory Database (reviewed) High CVE-2026-105855

Packages

EcosystemPackageAffectedFixed in
npm payload < 3.90.0 3.90.0
npm payload >= 4.0.0-canary.0, < 4.0.0-canary.34 4.0.0-canary.34

Details

As written in the advisory (Markdown source, shown as plain text).

## Impact When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

References

External links from the advisory. They lead to third-party sites.