CVE-2026-11779: PayloadCMS Authorization Bypass Vulnerability

CVE-2026-11779 Overview

CVE-2026-11779 is an Improper Authorization vulnerability in PayloadCMS version 3.84.1. The flaw exists in the account unlock operation, which lacks sufficient access control checks. Authenticated attackers with low privileges can unlock user accounts that were previously locked due to failed authentication attempts. This weakness maps to [CWE-307] Improper Restriction of Excessive Authentication Attempts, weakening the brute-force protection that account lockout is designed to provide.

Critical Impact
An authenticated attacker with low privileges can bypass account lockout controls in PayloadCMS 3.84.1, enabling continued credential-guessing attempts against locked accounts and undermining brute-force defenses.

Affected Products

PayloadCMS version 3.84.1
PayloadCMS deployments exposing the account unlock endpoint
Applications built on the affected PayloadCMS release

Discovery Timeline

2026-06-26 - CVE-2026-11779 published to the National Vulnerability Database (NVD)
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-11779

Vulnerability Analysis

The vulnerability affects PayloadCMS 3.84.1, an open-source headless content management system built on Node.js. The account unlock operation does not enforce sufficient authorization checks before executing. As a result, a low-privileged authenticated user can invoke the unlock function against accounts they should not control.

Account lockout is a standard defense against credential brute-force attacks. When unlock operations lack proper authorization, that defense collapses. The vulnerability allows an attacker to reset the lockout state and continue password-guessing attempts against a target account.

Exploitation requires network access and valid low-privileged credentials. No user interaction is required. The confidentiality and integrity impact is limited, and availability is not directly affected.

Root Cause

The root cause is missing or insufficient authorization enforcement in the code path that handles account unlock requests. The operation trusts the authenticated session without verifying that the caller has administrative rights or ownership over the target account. This aligns with [CWE-307], where controls intended to restrict repeated authentication attempts can be circumvented.

Attack Vector

The attack vector is network-based. An attacker authenticates to the PayloadCMS instance using low-privileged credentials, then issues an unlock request against a target user account. Because the endpoint does not validate authorization, the lockout state is cleared. The attacker can then resume automated password-guessing against the target account. No verified public exploit code is available. Refer to the Fluid Attacks Security Advisory for technical details.

Detection Methods for CVE-2026-11779

Indicators of Compromise

Repeated calls to the PayloadCMS account unlock endpoint from a single authenticated session
Failed authentication attempts against a user account that resume immediately after an unlock event
Unlock events initiated by non-administrative user accounts
Anomalous spikes in unlock operations across multiple user accounts in a short time window

Detection Strategies

Enable audit logging for all account unlock operations, capturing the caller identity and target account
Alert when the caller of an unlock operation does not hold an administrative role
Correlate unlock events with subsequent authentication failures against the same target account
Review PayloadCMS access logs for unlock requests originating from unexpected user roles or IP addresses

Monitoring Recommendations

Forward PayloadCMS application logs to a central log platform for retention and correlation
Baseline normal unlock operation volume and alert on deviations
Monitor for authentication failure patterns that resemble credential stuffing following unlock events
Track privileged operations invoked by low-privileged accounts as a general anomaly signal

How to Mitigate CVE-2026-11779

Immediate Actions Required

Inventory PayloadCMS deployments and identify instances running version 3.84.1
Restrict network exposure of the PayloadCMS admin API to trusted networks where feasible
Review recent unlock operations in application logs for signs of abuse
Rotate credentials for any accounts that show suspicious unlock activity

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Monitor the GitHub PayloadCMS Repository for a release addressing this issue and the Fluid Attacks Security Advisory for updated remediation guidance.

Workarounds

Enforce role-based access control at a reverse proxy or API gateway to block unlock requests from non-administrative users
Disable the self-service unlock flow if it is not required by the application
Require multi-factor authentication for all users to reduce the value of bypassing lockout
Shorten session lifetimes for low-privileged accounts to limit the window in which an authenticated attacker can act

bash

# Example reverse proxy rule to restrict unlock endpoint to admin role
# Adjust path and role claim to match your PayloadCMS deployment
location /api/users/unlock {
    if ($jwt_claim_role != "admin") {
        return 403;
    }
    proxy_pass http://payloadcms_backend;
}