CVE-2026-11779

PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

Affected

PayloadCMS

CVSS v4.0 FLUIDATTACKS

5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v4.0 GitHub

5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS

0.36% chance of exploitation in the next 30 days, 29th percentile

Published

2026-06-26

Proof-of-concept exploits (1)

• payloadcms/payload45286★ · 2026-10-16

Security advisories

• advisories/GHSA-jg8r-5jh2-v2xj

References

• CVE Record
• NVD entry

Related

• CVE-2022-27952
• CVE-2023-30843
• CVE-2025-4643
• CVE-2025-4644
• CVE-2026-105804
• CVE-2026-105805