PayloadCMS CVE-2026-11779

Q: What is the CVSS score of CVE-2026-11779?

CVE-2026-11779 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39799 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-06-26 Fluid Attacks

GHSA-jg8r-5jh2-v2xj

Information Disclosure Payloadcms

5.3

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible endpoint requires low-privilege auth (PR:L); no scope change; limited confidentiality and integrity impact from lockout bypass and account state disclosure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 17:29 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 npm packages depend on payload (4 direct, 4 indirect)

Ecosystem-wide dependent count for version 3.88.0.

DescriptionCVE.org

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

AnalysisAI

Improper authorization in PayloadCMS 3.84.1 allows low-privilege authenticated users to invoke the account unlock operation without sufficient access control, effectively bypassing the brute-force lockout mechanism protecting other user accounts. Reported by Fluid Attacks, this flaw has both a confidentiality and integrity dimension: attackers can disclose account state information and manipulate the lock status of accounts they do not own. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

PayloadCMS (cpe:2.3:a:payloadcms:payloadcms:*:*:*:*:*:*:*:*) is a Node.js-based open-source headless CMS maintained at github.com/payloadcms/payload. CWE-307 (Improper Restriction of Excessive Authentication Attempts) is the root-cause class, indicating that the account lockout mechanism - designed to throttle brute-force attacks - is undermined by an improperly guarded unlock API endpoint. Rather than restricting the unlock operation to administrators or the account owner through proper role/permission checks, the application performs insufficient authorization, allowing any authenticated low-privilege user to trigger an unlock for arbitrary accounts. This effectively negates a key anti-brute-force control at the application layer.

RemediationAI

No vendor-released patch with an exact fixed version has been identified from the provided data. Operators should monitor the PayloadCMS GitHub repository at https://github.com/payloadcms/payload and the Fluid Attacks advisory at https://fluidattacks.com/es/advisories/stitches for patch availability. As an immediate compensating control, restrict account unlock functionality to administrator roles only through PayloadCMS access control configuration - this limits the blast radius to already-privileged users. If user self-registration is enabled, consider temporarily disabling it or requiring manual approval until a patch is applied, since self-registered users represent the primary threat actor for this flaw. Additionally, enforce rate limiting at a reverse proxy or WAF layer on the unlock endpoint to add a second throttle independent of the application-level control. Note that disabling account registration may impact user onboarding workflows.