Feed/CVE-2026-105855
CVE-2026-105855HIGHCVSS 0.0

Payload didn't enforce field-level password update restrictions

Published Oct 6, 2026·Updated Oct 6, 2026

NVD Description

## Impact When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

Affected Packages (1)

payloadNPM
Fixed in 3.90.0

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free