Is CVE-2026-105855 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105855 being exploited in the wild.

How severe is CVE-2026-105855?

High severity, with a CVSS score of 4, published 6 October 2026.

Which products and versions are affected?

payload (npm) SEMVER:introduced=0,fixed=3.90.0; Payload CMS Payload = 4.0.0-canary.0 and < 4.0.0-canary.34.

Is there a fix for CVE-2026-105855?

Yes. payload (npm): upgrade to 3.90.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105855 attacked?

It is attacked over the network.

Am I affected by CVE-2026-105855?

Check whether you run payload (npm) or Payload CMS Payload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105855: Payload CMS access control bypass in password field update

Q: Is there a fix for CVE-2026-105855?

Yes. payload (npm): upgrade to 3.90.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-105855 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-105855?

Check whether you run payload (npm) or Payload CMS Payload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105855 · Severity: high · CVSS 4 · Published 2026-10-06

Payload is a headless CMS and backend framework that manages content and user authentication. A vulnerability allows authenticated users to bypass field-level restrictions and update password fields they should not have permission to modify, potentially leading to account takeover or unauthorized credential changes.

Technologies: payload (npm), Payload CMS Payload. Vendors: npm, Payload CMS.

Quick answers

Is CVE-2026-105855 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105855 being exploited in the wild.
How severe is CVE-2026-105855?: High severity, with a CVSS score of 4, published 6 October 2026.
Which products and versions are affected?: payload (npm) SEMVER:introduced=0,fixed=3.90.0; Payload CMS Payload < 3.90.0, >= 4.0.0-canary.0 and < 4.0.0-canary.34.
Is there a fix for CVE-2026-105855?: Yes. payload (npm): upgrade to 3.90.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105855 attacked?: It is attacked over the network.
Am I affected by CVE-2026-105855?: Check whether you run payload (npm) or Payload CMS Payload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

payload (npm): upgrade to 3.90.0 or later
```
npm install payload@3.90.0
```

Technical details

The vulnerability is an improper access control flaw (CWE-284) in Payload's authentication collection where field-level access.update restrictions on password fields are not enforced server-side. An authenticated attacker with low privileges and network access can send requests to modify password fields despite configured restrictions, gaining confidentiality and integrity impacts.

Affected products

Payload CMS Payload < 3.90.0, >= 4.0.0-canary.0 and < 4.0.0-canary.34

Identifiers

CVE-2026-105855
GHSA-fx49-4h83-wjv9

Timeline

2026-09-18: disclosed: Vulnerability published in payloadcms/payload
2026-10-06: advisory: GitHub Security Advisory GHSA-fx49-4h83-wjv9 published

References

https://api.github.com/users/pavelkohout396

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.