Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts

Description

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

Recommendation

No fix is available yet. Followings are affected versions:

<= 3.88.0

References

GHSA-jg8r-5jh2-v2xj
fluidattacks.com
CVE-2026-11779
CWE-307
CAPEC-310

Could your website be exposed too?

SmartScanner can check your website for Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts and gives you actionable findings to investigate.

Start a free scan

Related Issues

Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - CVE-2026-46396
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player - CVE-2026-46396
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck - CVE-2026-39397
Payload: Token refresh and password reset responses may expose restricted user fields - CVE-2026-105853

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated September 04, 2026