{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.88.0"}],"component":"payload","cve_ids":["CVE-2026-11779"],"ecosystem":"npm","epss":0.00364,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-jg8r-5jh2-v2xj","id":"tcs_01M5KFXZ6GY4WGQFGHRQ55XXEB","modified_at":"2026-09-04T19:10:34.247083Z","published_at":"2026-06-26T18:33:59Z","references":["https://osv.dev/vulnerability/GHSA-jg8r-5jh2-v2xj","https://nvd.nist.gov/vuln/detail/CVE-2026-11779","https://fluidattacks.com/es/advisories/stitches","https://github.com/payloadcms/payload"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-jg8r-5jh2-v2xj","url":"https://osv.dev/vulnerability/GHSA-jg8r-5jh2-v2xj"},{"source":"nvd","source_id":"CVE-2026-11779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11779"}],"summary":"Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts"}