What is GHSA-jg8r-5jh2-v2xj?

GHSA-jg8r-5jh2-v2xj is a security advisory published by GitHub Security Advisories with Medium severity. Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts

Which CVE IDs does GHSA-jg8r-5jh2-v2xj cover?

GHSA-jg8r-5jh2-v2xj covers the following CVE IDs: CVE-2026-11779. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-jg8r-5jh2-v2xj?

GHSA-jg8r-5jh2-v2xj affects 1 product, including: npm/payload:\u003c= 3.88.0.

GHSA-jg8r-5jh2-v2xjMedium

Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts

Vendor

GitHub Security Advisories

Published

June 26, 2026

Last Modified

September 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-11779 →

📋 Description

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

🎯 Affected products1

npm/payload:<= 3.88.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-11779
https://fluidattacks.com/es/advisories/stitches
https://github.com/payloadcms/payload
https://github.com/advisories/GHSA-jg8r-5jh2-v2xj