CVE-2026-105858: Payload: Remote Code Execution through first-register

October 7, 2026

A crafted request to the public first-register operation can be used to perform a RCE exploit.

You are affected if:

You use local auth strategy and your application remains without an initial user created

References

github.com/advisories/GHSA-97rh-rhh2-7vjv
github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv
nvd.nist.gov/vuln/detail/CVE-2026-105858

Code Behaviors & Features

Detect and mitigate CVE-2026-105858 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →