Most recent entries from all

fkie_cve-2026-105855

2026-10-07T19:13:31.293992+00:00

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

GHSA-fx49-4h83-wjv9 — Payload didn't enforce field-level password update restrictions

2026-10-07T19:13:31.294104+00:00

Affected: npm: payload

## Impact

When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly.

## Patches

Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.