Summary
Payload didn't enforce field-level password update restrictions
Advisory details
Impact
When an auth collection defined a field-level access.update restriction on the password field, the restriction was not enforced on the server correctly.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-106495
Backstage: Improper access control in backend action invocation
- HIGHCVE-2026-103929
mise permits untrusted local configuration to override default shell arguments
- MEDIUMGHSA-pjr3-86v4-5p7w
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
- HIGHCVE-2026-61426
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure
- HIGHCVE-2026-106503
Backstage: Scaffolder action input authorization bypass
- HIGHCVE-2026-57449
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token