CVE-2026-11779: Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts

June 26, 2026 (updated September 4, 2026)

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

References

fluidattacks.com/es/advisories/stitches
github.com/advisories/GHSA-jg8r-5jh2-v2xj
github.com/payloadcms/payload
nvd.nist.gov/vuln/detail/CVE-2026-11779

Code Behaviors & Features

Detect and mitigate CVE-2026-11779 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →