What’s Vulnerable › Vulnerabilities

CVE-2026-105866: Payload: Unauthenticated account-lockout denial of service

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-15
• Weakness: CWE-307

Description

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Affected products

• payloadcms payload: before 3.90.0; 4.0.0-canary0, 4.0.0-canary1, 4.0.0-canary10, 4.0.0-canary11, 4.0.0-canary12, 4.0.0-canary13 (+28) — fixed in 3.90.0

How to fix

Upgrade to a fixed version: payloadcms payload 3.90.0. Check the vendor advisory for mitigations.

References

• https://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1
• https://github.com/payloadcms/payload/releases/tag/v3.90.0
• https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w

Get alerted when CVE-2026-105866 or the next vulnerability affects your stack