EUVD-2026-93499
GHSA-fx49-4h83-wjv9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated with document update rights (PR:L); AC:H because the targeted collection must have a specific field-level password restriction configured (modeled as AT:P in 4.0); credential overwrite yields C:H/I:H, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 2 npm packages depend on payload (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.0.0-canary.0.
DescriptionCVE.org
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
AnalysisAI
Authenticated users who can update an auth collection document in Payload CMS can change the password field on that document even when the collection explicitly defines a field-level access.update restriction intended to deny it, allowing account takeover of the affected user. The flaw affects the npm payload package before 3.90.0 and canary releases from 4.0.0-canary.0 through 4.0.0-canary.34, and exploitation is conditional: the deployment must have configured a field-level password update restriction, local auth must be active, and the write must not be a draft save. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Payload auth collection explicitly defines a field-level access.update restriction on the password field, with the local auth strategy active (disableLocalStrategy not fully disabling local fields) and the request not saving a draft - these are the exact conditions under which the server was supposed to reject the password change but did not. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional integrity flaw rather than an internet-scale emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the `payload` package to 3.90.0 or later, or to 4.0.0-canary.34 or later on the canary line, as documented in GHSA-fx49-4h83-wjv9 (https://github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9) and shipped via the v3.90.0 release tag (https://github.com/payloadcms/payload/releases/tag/v3.90.0); the fix is the commit at https://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Payload CMS deployments and identify any running the npm payload package below 3.90.0 or canary builds 4.0.0-canary.0 through 4.0.0-canary.34, confirming for each whether local authentication is active and whether field-level password update restrictions are in place; for those affected, immediately reduce update rights on authentication collections to the smallest possible set of trusted identities, enable multi-factor authentication and alerting on password-change events, and review recent password changes for anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbit
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker sub
Malformed multipart request bodies sent to Payload CMS versions 3.0.0 through 3.89.x and 4.0.0-canary.0 through 4.0.0-ca
Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the
Payload CMS prior to 3.73.0 has a SQL injection vulnerability when querying structured data, enabling database compromis
Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote
Payload CMS (npm package `payload`) versions 3.0.0 through 3.89.x and 4.0.0-canary builds before canary.34 hash account
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access t
Authentication claim injection in Payload CMS affects versions after 3.0.0 and before 3.90.0, where a collection field c
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Str
Stored Cross-Site Scripting (XSS) in Payload CMS versions prior to 3.78.0 allows authenticated users with write permissi
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today