CVE-2026-105855: Payload didn't enforce field-level password update restrictions

October 6, 2026

When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly.

References

github.com/advisories/GHSA-fx49-4h83-wjv9
github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9
nvd.nist.gov/vuln/detail/CVE-2026-105855

Code Behaviors & Features

Detect and mitigate CVE-2026-105855 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →