Payload didn't enforce field-level password update restrictions

Description

When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly.

Recommendation

Update the payload package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34

  < 3.90.0**

• Patched version(s): **4.0.0-canary.34

  3.90.0**

References

• GHSA-fx49-4h83-wjv9
• CVE-2026-105855
• CWE-284
• CAPEC-310