CVE-2026-105858 · GHSA-97rh-rhh2-7vjv
Payload: Remote Code Execution through first-register
- Risk score
- 67/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed i…
- Affected
- payload (npm) < 3.90.0; payload (npm) >= 4.0.0-canary.0, < 4.0.0-canary.34
- Fix
- Upgrade payload to 3.90.0 or 4.0.0-canary.34 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.1 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| payload | npm | < 3.90.0 | 3.90.0 |
| payload | npm | >= 4.0.0-canary.0, < 4.0.0-canary.34 | 4.0.0-canary.34 |
References
- https://github.com/advisories/GHSA-97rh-rhh2-7vjv
- https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv
- https://nvd.nist.gov/vuln/detail/CVE-2026-105858
- https://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679
- https://github.com/payloadcms/payload/releases/tag/v3.90.0
- https://github.com/advisories/GHSA-97rh-rhh2-7vjv
Original description
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Last activity 6 Oct 2026. Patch Forecast updates every hour.