~ / search / GHSA-jg8r-5jh2-v2xj

GHSA-jg8r-5jh2-v2xj

Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-11779

Packages

EcosystemPackageAffectedFixed in
npm payload <= 3.88.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

References

External links from the advisory. They lead to third-party sites.