CVE-2026-105855: Payload: Field-level password update restrictions were not enforced

Q: Which deployments are affected?

Affected deployments use Payload authentication collections that define a field-level access.update restriction on the password field. Payload versions before 3.90.0, and canary versions before 4.0.0-canary.34, are affected.

Q: What level of access does an attacker need?

The CVSS vector indicates that an attacker needs low privileges and can exploit the issue over the network without user interaction. Exploitation also depends on the target having a password-field access.update restriction that the server fails to enforce.

Q: What is the recommended remediation?

Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later for the canary release line. These versions enforce the password field's field-level access.update restriction correctly.

Published Oct 6, 2026

Updated

Impact

When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Other sources

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

— MITRE

Affected Software

3 affected componentsFixes available

Payload Payload<3.90.0, <4.0.0-canary.34

npm/payload>=4.0.0-canary.0<4.0.0-canary.34

4.0.0-canary.34

npm/payload<3.90.0

3.90.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/payload to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34
Upgrade
Upgrade npm/payload to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload packages to a version that resolves this vulnerability.
Fixed in 3.90.0Patch 4.0.0-canary.34

Event History

Oct 6, 2026

CVE Published

via MITRE·04:18 PM

Data Sourced

via MITRE·04:18 PM

DescriptionWeakness

Advisory Published

via GitHub·04:21 PM

Data Sourced

via GitHub·04:21 PM

DescriptionWeaknessAffected Software

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected deployments use Payload authentication collections that define a field-level access.update restriction on the password field. Payload versions before 3.90.0, and canary versions before 4.0.0-canary.34, are affected.

What level of access does an attacker need?

The CVSS vector indicates that an attacker needs low privileges and can exploit the issue over the network without user interaction. Exploitation also depends on the target having a password-field access.update restriction that the server fails to enforce.

What is the recommended remediation?

Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later for the canary release line. These versions enforce the password field's field-level access.update restriction correctly.

CVE-2026-105855: Payload: Field-level password update restrictions were not enforced

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What is the recommended remediation?