npm/payload CVE-2026-11779: medium 5.3, EPSS 0.36%
Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.88.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-jg8r-5jh2-v2xj
- nvd: CVE-2026-11779
- https://fluidattacks.com/es/advisories/stitches
- https://github.com/payloadcms/payload
CVE-2026-11779 · published · modified · JSON