{"id":"EUVD-2026-93502","enisaUuid":"11249a3e-d7a7-3750-adfa-3d68bd9cad52","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:29:52 PM","dateUpdated":"Oct 9, 2026, 1:14:15 AM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv\nhttps://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105858\nGHSA-97rh-rhh2-7vjv\n","assigner":"GitHub_M","epss":0.48,"enisaIdProduct":[{"id":"03a851a2-2d5d-338a-9f1f-40c7450bb67b","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"f8d85e56-fa7b-309e-a2c5-e6d68ac16bfa","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"enisaIdVendor":[{"id":"9e178dfa-1f4e-3319-934a-89e4a9474636","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"11e60e8e-fa85-3a77-aba9-f29e737070f2","vulnerability":{"id":"GHSA-97rh-rhh2-7vjv","description":"Payload: Remote Code Execution through first-register","datePublished":"Oct 7, 2026, 8:29:58 PM","dateUpdated":"Oct 7, 2026, 8:29:58 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105858\nhttps://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93502\n","aliases":"GHSA-97rh-rhh2-7vjv\nCVE-2026-105858\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d12ec326-38f4-3b8f-bb8f-23fc869b311a","vulnerability":{"id":"CVE-2026-105858","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:29:52 PM","dateUpdated":"Oct 9, 2026, 1:14:15 AM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv\nhttps://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93502\n","assigner":"GitHub_M","epss":0.48,"dataProcessed":"Nov 2, 2026, 7:16:47 AM","vulnerabilityProduct":[{"id":"1356d649-f56f-36ad-a52d-aa31ff552269","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"8d73bcdf-d3e6-31bd-8ade-44ea66ac917c","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"vulnerabilityVendor":[{"id":"d706882d-f1af-3a11-9dac-6d475cda70ca","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}