{"id":"CVE-2026-105855","aliases":["GHSA-fx49-4h83-wjv9"],"url":"https://o3.security/vulnerability/CVE-2026-105855","summary":"Payload: Field-level password update restrictions were not enforced","details":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","published":"2026-10-06T16:18:53.672Z","modified":"2026-10-16T02:47:41.918237428Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"payload","fixedVersion":"3.90.0"},{"ecosystem":"npm","name":"payload","fixedVersion":"4.0.0-canary.34"}],"fix":{"url":"https://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e","label":"payloadcms/payload@9de9e79"},"references":[{"type":"WEB","url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105855.json"},{"type":"ADVISORY","url":"https://github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105855"},{"type":"FIX","url":"https://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e"},{"type":"PACKAGE","url":"https://github.com/payloadcms/payload"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-16T02:47:41.918237428Z"}}