Medium severity · published Jun 26, 2026
CVE-2026-11779
PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
PayloadCMS · PayloadCMS
3.84.1 · source: vendor