What is GHSA-fx49-4h83-wjv9?

GHSA-fx49-4h83-wjv9 is a security advisory published by GitHub Security Advisories with High severity. Payload didn't enforce field-level password update restrictions

Which CVE IDs does GHSA-fx49-4h83-wjv9 cover?

GHSA-fx49-4h83-wjv9 covers the following CVE IDs: CVE-2026-105855. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-fx49-4h83-wjv9?

GHSA-fx49-4h83-wjv9 affects 2 products, including: npm/payload:\u003c 3.90.0; npm/payload:\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.34.

GHSA-fx49-4h83-wjv9High

Payload didn't enforce field-level password update restrictions

Vendor

GitHub Security Advisories

Published

October 6, 2026

Last Modified

October 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-105855 →

📋 Description

Impact

When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly.

Patches

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

🎯 Affected products2

npm/payload:< 3.90.0
npm/payload:>= 4.0.0-canary.0, < 4.0.0-canary.34

🔗 References (4)

https://github.com/payloadcms/payload/security/advisories/GHSA-fx49-4h83-wjv9
https://github.com/payloadcms/payload/commit/9de9e7911e29d60870a1d5480412524c63d6411e
https://github.com/payloadcms/payload/releases/tag/v3.90.0
https://github.com/advisories/GHSA-fx49-4h83-wjv9