CVE-2026-11779

5.3 mediumEPSS 0.4%

Medium (5.3). EPSS 0.4% chance of exploitation in the next 30 days.

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

Severity

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-307
Published: 2026-06-26
Modified: 2026-06-26
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-jg8r-5jh2-v2xj	npm	payload	<=3.88.0	no fix published