CVE-2026-11779: PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access
An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to PayloadCMS account unlock functionality (the account unlock operation) to only explicitly authorized users, since PayloadCMS 3.84.1 has an authenticated lockout bypass via default unlock access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11779?
CVE-2026-11779 is rated with a risk score of 34, indicating a significant security concern.
How do I fix CVE-2026-11779?
To mitigate CVE-2026-11779, ensure that access controls for the account unlock operation in PayloadCMS 3.84.1 are properly implemented.
What does CVE-2026-11779 affect?
CVE-2026-11779 affects PayloadCMS version 3.84.1 due to its improper authorization during the account unlock process.
What type of vulnerability is CVE-2026-11779?
CVE-2026-11779 is classified as an Improper Authorization vulnerability.
Can CVE-2026-11779 lead to unauthorized account access?
Yes, CVE-2026-11779 may allow attackers to bypass account lockouts, leading to unauthorized access to user accounts.