Is CVE-2026-11779 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11779 being exploited in the wild.

How severe is CVE-2026-11779?

Medium severity, with a CVSS score of 4, published 26 June 2026.

Which products and versions are affected?

payload (npm) <= 3.88.0, SEMVER:introduced=0,last_affected=3.88.0; Payload CMS <= 3.88.0.

Is there a fix for CVE-2026-11779?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11779 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-11779?

Check whether you run payload (npm) or Payload CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11779: PayloadCMS Improper Authorization in account unlock operation

Q: Which products and versions are affected?

payload (npm) <= 3.88.0, SEMVER:introduced=0,last_affected=3.88.0; Payload CMS <= 3.88.0.

Q: Is there a fix for CVE-2026-11779?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-11779 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-11779?

Check whether you run payload (npm) or Payload CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11779 · Severity: medium · CVSS 4 · Published 2026-06-26

Payload CMS is a popular open-source Next.js-based backend and content management system. An access control flaw allows any authenticated user to unlock other users' locked accounts, potentially granting attackers access to compromised or restricted accounts. This could enable unauthorized access to sensitive data or system functionality if account lockouts were being used to temporarily restrict access.

Technologies: payload (npm), Payload CMS. Vendors: npm, Payload.

Quick answers

Is CVE-2026-11779 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11779 being exploited in the wild.
How severe is CVE-2026-11779?: Medium severity, with a CVSS score of 4, published 26 June 2026.
Which products and versions are affected?: payload (npm) <= 3.88.0, SEMVER:introduced=0,last_affected=3.88.0; Payload CMS <= 3.88.0.
Is there a fix for CVE-2026-11779?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11779 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-11779?: Check whether you run payload (npm) or Payload CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as an improper authorization (CWE-307) flaw affecting the account unlock operation. The root cause is insufficient access control checks on the unlock endpoint, allowing any authenticated user to reset lockout status for arbitrary accounts without verifying authorization. The attack requires network access and valid authentication credentials, but does not require user interaction or administrative privileges. An attacker with a low-privilege user account can call the unlock API to reset lockouts on other user accounts, potentially circumventing account security measures. Payload CMS versions up to 3.88.0 are affected; no patched version has been released as of the advisory publication date.

Affected products

Payload Payload CMS <= 3.88.0

Identifiers

CVE-2026-11779
GHSA-jg8r-5jh2-v2xj

Timeline

2026-06-26: disclosed: Published by GitHub Advisory Database and NVD
2026-09-04: advisory: GitHub reviewed and updated advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.