{"id":"EUVD-2026-93499","enisaUuid":"235998a2-f50e-3394-99e0-5311e07a7a54","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:18:53 PM","dateUpdated":"Oct 6, 2026, 5:18:56 PM","baseScore":7.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9\nhttps://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105855\nGHSA-fx49-4h83-wjv9\n","assigner":"GitHub_M","epss":0.25,"enisaIdProduct":[{"id":"2c3876ba-97da-31d6-baf7-45951c619839","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"d95786b9-2d38-38ff-81f1-605ce3b901a7","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"enisaIdVendor":[{"id":"e9e72ec9-dedb-36f0-a9cc-e9bbcc187195","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"68dd0b1d-01dc-3dde-a2a8-3a3f111d65c1","vulnerability":{"id":"GHSA-fx49-4h83-wjv9","description":"Payload didn\u0027t enforce field-level password update restrictions","datePublished":"Oct 6, 2026, 4:21:52 PM","dateUpdated":"Oct 6, 2026, 4:21:52 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9\nhttps://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93499\n","aliases":"CVE-2026-105855\nGHSA-fx49-4h83-wjv9\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"708e20b6-b5b6-3a1d-971e-75a3fbe2e59b","vulnerability":{"id":"CVE-2026-105855","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:18:53 PM","dateUpdated":"Oct 6, 2026, 5:18:56 PM","status":"PUBLISHED","baseScore":7.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9\nhttps://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93499\n","assigner":"GitHub_M","epss":0.25,"dataProcessed":"Oct 27, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"a8b636cd-733a-3ad1-ae37-6f38db6b1bea","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"bdce0282-bd21-3167-8039-835229ab4888","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"vulnerabilityVendor":[{"id":"3a409f52-234d-376d-8807-d0554e61c032","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}