{"id":"EUVD-2026-93512","enisaUuid":"0a31eff6-eee2-324b-ab36-a10267321e87","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:46:31 PM","dateUpdated":"Oct 6, 2026, 5:39:09 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w\nhttps://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105866\nGHSA-v5gf-vpjc-pc7w\n","assigner":"GitHub_M","epss":0.37,"enisaIdProduct":[{"id":"8de0355a-eaf6-36f8-859b-eba51ef34bf3","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"e7251831-8f28-386b-aa28-30453e27eaef","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"}],"enisaIdVendor":[{"id":"bb162834-9ea0-3801-a4df-af2fe84cebfc","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"a572235a-81f7-384a-801e-f231515615ca","vulnerability":{"id":"GHSA-v5gf-vpjc-pc7w","description":"Payload: Unauthenticated account-lockout denial of service","datePublished":"Oct 7, 2026, 8:29:04 PM","dateUpdated":"Oct 7, 2026, 8:29:04 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105866\nhttps://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93512\n","aliases":"GHSA-v5gf-vpjc-pc7w\nCVE-2026-105866\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d1a32d61-fbe4-3264-917c-37123368c322","vulnerability":{"id":"CVE-2026-105866","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:46:31 PM","dateUpdated":"Oct 6, 2026, 5:39:09 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w\nhttps://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93512\n","assigner":"GitHub_M","epss":0.37,"dataProcessed":"Nov 8, 2026, 7:16:13 AM","vulnerabilityProduct":[{"id":"0d2afbc6-90f9-38ad-8654-69948e38108c","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"7d22b68c-3d50-3065-98dc-dcc47fcabc82","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"vulnerabilityVendor":[{"id":"3c2b1a4e-2d34-3e13-8deb-f7d780bbba62","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}