Kurz gesagt
- CVE-2026-105866 ist eine Schwachstelle (HOCH (CVSS 7.5)) in payload (payloadcms), payload.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.37%, höher als bei 30.8% aller Schwachstellen.
- Abhilfe: auf 3.90.0, 4.0.0-canary.34 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| payload | = 4.0.0< 3.90.0
| 3.90.0
|
| payload npm | ≥ 4.0.0-canary.0, < 4.0.0-canary.34< 3.90.0
| 4.0.0-canary.343.90.0
|
Description
Impact
An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in.
You are affected if:
- Using an affected Payload version with an auth-enabled collection that uses local authentication and account lockout.
Applications that do not use Payload local authentication are not affected.
Patches
Successful password resets now clear the account’s lockout state. The forgot-password flow also enforces a configurable minimum interval between reset emails, which defaults to 15 seconds.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
NVD description
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free