CVE-2026-105855: Payload Package Field-Level Password Update Restriction Bypass
Summary
CVE-2026-105855: Payload didn't enforce field-level password update restrictions. Affects payload across 2 version ranges.
< 3.90.0
>= 4.0.0-canary.0, < 4.0.0-canary.34
Fixed in 3.90.0 or 4.0.0-canary.34, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Payload is an open-source content management system (CMS) built for developers, allowing them to create and manage custom applications with ease. It provides a flexible API and a user-friendly interface, making it a popular choice for building modern web applications. However, the recent vulnerability exposes a critical flaw in its authentication mechanism, specifically regarding field-level access restrictions on password updates.
Vulnerability Detail
The vulnerability arises from the failure of the Payload package to enforce field-level access restrictions on the password field during updates. This means that unauthorized users could potentially change user passwords without proper permissions, leading to unauthorized access and compromising user accounts. The issue is rooted in the server-side validation logic, which does not correctly apply the defined restrictions, allowing for exploitation.
How To Fix
Latest published version: 3.92.0 as of 23 Oct 2026
npm install payload@3.92.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.90.03.90.0npm install payload@3.90.0 -
>= 4.0.0-canary.0, < 4.0.0-canary.344.0.0-canary.34npm install payload@4.0.0-canary.34
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the password update functionality through application-level controls until the package can be updated. Ensure that only authorized personnel have access to modify user passwords.
Conclusion
In summary, CVE-2026-105855 presents a significant security risk for users of the Payload package due to its failure to enforce password update restrictions. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for payload →
FAQ
CVE-2026-105855 is a vulnerability in the Payload package that allows unauthorized users to update passwords due to improper enforcement of field-level access restrictions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow unauthorized users to change passwords, leading to potential account takeovers and data breaches.
If an immediate update is not possible, implement strict access controls to the password update functionality as a temporary measure.
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for payload.
