Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
References
| Link | Resource |
|---|---|
| https://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1 | Patch |
| https://github.com/payloadcms/payload/releases/tag/v3.90.0 | Patch Release Notes |
| https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Oct 2026, 00:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Payloadcms payload
Payloadcms |
|
| CPE | cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:* cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:* |
|
| References | () https://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1 - Patch | |
| References | () https://github.com/payloadcms/payload/releases/tag/v3.90.0 - Patch, Release Notes | |
| References | () https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
06 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 17:17
Updated : 2026-10-15 00:08
NVD link : CVE-2026-105866
Mitre link : CVE-2026-105866
CVE.ORG link : CVE-2026-105866
JSON object : View
Products Affected
payloadcms
- payload