Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.6
CVE-2026-11779: PayloadCMS 3.84.1 lets logged‑in users bypass account lockout
CVE-2026-11779 · published 4 months ago
Summary
In PayloadCMS version 3.84.1, a logged‑in user can unlock another user's account without proper permission. This could allow someone who has already gained access to restore a locked account and continue using it. Apply the vendor’s update or adjust the unlock settings to require proper authorization.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | elliotpayload | payload | <= 3.88.0 |
| npm | – | payload | <= 3.88.0 |
Original advisory text
PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access
An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.
References
- https://fluidattacks.com/es/advisories/stitches Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-11779 Vendor Advisory
- https://github.com/payloadcms/payload Product
- https://github.com/advisories/GHSA-jg8r-5jh2-v2xj
- https://registry.npmjs.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11779... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.6
High
Type
CWE-307Improper Restriction of Excessive Authentication Attempts
Timeline
Published26 Jun 2026
Updated4 Nov 2026
First seen26 Jun 2026
Sources
CVE-2026-11779 · NVD
GHSA-jg8r-5jh2-v2xj · GHSA
GHSA-jg8r-5jh2-v2xj · OSV
CVE-2026-11779 · OSV
Track software like this
Free during beta