CVE-2026-11779
CVE-2026-11779 · PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.
CVSS 5.3 · Medium · EPSS 0.4%
- Published
- Updated
Stack: node
Affected products and versions
payloadcms
- Versions
- 3.84.1: Affected
No fix published
payload npm
- Affected ranges
- SEMVER: ≤ 3.88.0
No fix published