Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
References
| Link | Resource |
|---|---|
| https://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e | Patch |
| https://github.com/payloadcms/payload/releases/tag/v3.90.0 | Patch Release Notes |
| https://github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Oct 2026, 00:11
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Payloadcms payload
Payloadcms |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
| CPE | cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:* |
|
| References | () https://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e - Patch | |
| References | () https://github.com/payloadcms/payload/releases/tag/v3.90.0 - Patch, Release Notes | |
| References | () https://github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9 - Vendor Advisory |
06 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 17:17
Updated : 2026-10-15 00:11
NVD link : CVE-2026-105855
Mitre link : CVE-2026-105855
CVE.ORG link : CVE-2026-105855
JSON object : View
Products Affected
payloadcms
- payload
CWE
CWE-284
Improper Access Control