EUVD-2026-93502
GHSA-97rh-rhh2-7vjv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify uninitialized Payload instance (no admin user)
-
DeliverySend crafted first-register request
-
ExploitTrigger code injection in registration handler
-
ExecutionExecute arbitrary code on server
-
ImpactFull host/application compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Payload instance to have local authentication enabled AND no initial (first) admin user yet created - i.e., a brand-new, freshly deployed, or re-provisioned instance within the setup window before admin signup is completed. The attack targets the public first-register operation specifically. Limiting factors: once any admin/first user has been created the attack surface closes, which is why CVSS rates AC:H; the window is transient and non-default for long-running production instances, substantially narrowing realistic exploitation to newly stood-up or automated/ephemeral deployments. No authentication or user interaction is required (PR:N/UI:N) while the instance remains uninitialized. |
| Impact | This is a genuine high-priority issue despite several mitigating conditions. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, base 8.1) describes a network-reachable, unauthenticated (PR:N) code-injection flaw (CWE-94) with full confidentiality, integrity and availability impact - consistent with the RCE/Code Injection tags. The AC:H rating is the key nuance: exploitation is not against any running Payload instance but only during the narrow window when local authentication is enabled and no initial admin user has yet been created (a fresh or uninitialized deployment). No EPSS score, CISA KEV entry, or public POC was supplied in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is driven by the inherent severity of unauthenticated RCE, not by observed in-the-wild activity. The vendor fix is confirmed (3.90.0 and 4.0.0-canary.34) with a referenced commit and security advisory (GHSA-97rh-rhh2-7vjv), which raises confidence in the vulnerability's reality and makes patching straightforward. Net: prioritize patching, but the AC:H setup-window requirement means it is more dangerous for newly provisioned/self-hosted instances than for long-established, already-initialized ones. |
| Exploit ScenarioDerived | An attacker discovers a freshly deployed or re-provisioned Payload CMS instance that has local authentication enabled but no first admin user yet created. They send a crafted request to the public first-register operation, which injects and executes attacker-controlled code on the server before any legitimate operator completes initial admin signup. No public proof-of-concept was provided in the intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Remote code execution in Payload CMS before 3.90.0 (and canary builds before 4.0.0-canary.34) lets a remote, unauthenticated attacker execute arbitrary code by sending a crafted request to the public first-register operation. The flaw only applies to instances that have local authentication enabled and have not yet had their first admin user created, i.e. a freshly deployed, re-provisioned, or ephemeral instance still inside its initial setup window; once an admin exists the attack surface disappears. No public exploit identified at time of analysis, and no evidence of active exploitation (not in CISA KEV), though the CVSS 8.1 score with full confidentiality, integrity and availability impact makes this a high-priority fix for anyone running uninitialized deployments.
RemediationAI
Vendor-released patch: upgrade to Payload CMS 3.90.0 (stable) or 4.0.0-canary.34 (canary), which add exact-match validation of public admin routes so that only legitimate verification routes for auth-enabled collections bypass admin authentication. Because the exposure window is defined by the absence of an initial user, the most effective compensating control is procedural: complete the first-admin registration before the instance is reachable from untrusted networks - stand the deployment up on loopback or a private network, create the first admin user, then expose it publicly; this is safe but requires changing automated/ephemeral deployment pipelines, since containerized rollouts that publish the service immediately remain exposed until setup completes. Where a pre-exposure setup step is impractical, restrict inbound access to the admin and first-register paths (e.g. firewall or reverse-proxy allowlists scoped to the setup operator's addresses) until initialization finishes, accepting the trade-off that legitimate remote administrators cannot reach the admin UI during that period; blocking the entire admin base path is a heavier variant with the same side effect. Note that disabling local authentication in favor of an external auth provider also removes the precondition, but is an architectural change rather than a quick mitigation. After upgrading, verify the fix is present and confirm that an admin user exists on every deployed instance, as an uninitialized production instance is the single prerequisite an attacker needs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Payload is a free and open source headless content management system built on Node.js and Next.js, where the admin UI and REST/GraphQL APIs are served from the same Next.js application. The vulnerability class is CWE-94 (improper control of generation of code / code injection): influence over a request that reaches a first-register flow is translated into executed code rather than merely stored data. The public-facing admin route classification logic lives in packages/next (the isPublicAdminRoute utility), which decides which admin paths are reachable without an authenticated admin session - the initial first-user registration and account-verification routes are intentionally public during setup. The vendor fix commit (e947fc4ba4a434f276d043386e501b1d14eda679) tightens that allowlist, replacing a loose substring check on '/verify/' with an exact structural match requiring a three-segment route whose middle segment is 'verify' and whose first segment corresponds to a collection with auth enabled; it also renames the accompanying comment to clarify that these routes are 'accessible without admin authentication' and adds a spec file (isPublicAdminRoute.spec.ts) covering positive and negative route cases. The affected component per CPE is cpe:2.3:a:payloadcms:payload:*:*:*:*:*:*:*:*, and exploitation is only reachable while local (email/password) authentication is enabled and the instance is still uninitialized; the network vector is AV:N but complexity is rated high (AC:H) because of this transient, non-default precondition, with PR:N and UI:N confirming that no credentials or user interaction are needed during that window.
Know when Payload gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable public endpoint (AV:N) with no auth (PR:N/UI:N), but only exploitable in the transient uninitialized-no-admin-user state (AC:H); code injection yields full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Blast Radius
ecosystem impact- 2 npm packages depend on payload (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.0.0-canary.0.
Technical POC Analysis
Evidence base: GitHub advisory GHSA-97rh-rhh2-7vjv only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Payload CMS carries a high-severity remote code execution flaw that is only reachable on deployments still inside their initial setup window - instances that have local authentication enabled and where no administrator account has yet been created. Organizations running freshly deployed, re-provisioned, or ephemeral Payload CMS environments (including container and CI/CD-driven rollouts) are exposed during that window, and a successful compromise would give an attacker full control over the confidentiality, integrity, and availability of the instance, with no public exploit identified at time of analysis. Because the exposure disappears the moment the first admin user exists, leadership should treat this as a time-sensitive deployment-hygiene and remediation problem concentrated in a small but easily overlooked slice of the environment.
Apply vendor patch: upgrade to Payload CMS 3.90.0 or later (canary builds to 4.0.0-canary.34 or later), verifying availability against the vendor advisory. Until patched, interim mitigations are: complete first-admin registration immediately on deployment so the vulnerable setup window closes; never expose uninitialized instances to untrusted networks (restrict first-register/admin endpoints to trusted management IPs or an internal network); isolate, decommission, or rebuild ephemeral and re-provisioned instances that have never had an admin created; and disable the local authentication strategy wherever local auth is not required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbit
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker sub
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access t
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Str
Malformed multipart request bodies sent to Payload CMS versions 3.0.0 through 3.89.x and 4.0.0-canary.0 through 4.0.0-ca
API key disclosure in Payload CMS lets an authenticated user with ordinary read access to other users' authentication do
Authenticated users who can update an auth collection document in Payload CMS can change the password field on that docu
Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34 contain an authorization bypass in relatio
Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the
Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that
Payload CMS prior to 3.73.0 has a SQL injection vulnerability when querying structured data, enabling database compromis
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote
Exploit-DB